Terms of Service

1 Scope and provider

1.1 Your contracting party is [Company name] [Legal form, e.g. GmbH], [Street and number], [Postcode and city], Germany, registered at [Register court and number, e.g. Amtsgericht … HRB …], VAT ID [VAT ID DE…], represented by [Managing director]. You can reach us by email at legal@northvault.com (general), support@northvault.com (support) and abuse@northvault.com (abuse reports), and by phone at [Phone number].

1.2 These Terms apply to every contract concluded through our website, the customer panel or otherwise for NorthVault services, in the version in force when the contract is concluded.

1.3 They apply to consumers within the meaning of § 13 of the German Civil Code (BGB) and to businesses within the meaning of § 14 BGB, legal entities under public law and special funds under public law. Provisions that apply only to consumers or only to businesses are marked as such.

1.4 Deviating, conflicting or supplementary terms of the Customer do not become part of the contract, even if we do not expressly object to them. Individual agreements made in text form take precedence over these Terms.

2 Definitions

• “Service”: each individual service ordered, i.e. a VPS or a website (web hosting), with the plan, location and term chosen for it.
• “VPS”: a virtual server in the form of an isolated container in which the Customer has administrator (root) rights.
• “Web hosting” / “Website”: storage and computing capacity for one website on a server shared by several customers, managed through the customer panel.
• “Customer panel”: the web interface through which the Customer orders, manages and cancels Services.
• “Customer account”: the Customer’s access to the customer panel, with their master data, Services, credit balance and history.
• “Credit balance”: money paid in advance into the customer account from which charges are settled.
• “Content”: all data, files, programs, databases, configurations and other information that the Customer or third parties store, process or transmit through the Customer’s Services.
• “Plan”: the tier of a Service (e.g. Basic, Plus, Pro, Business) with the resources stated in its service description.
• “Text form”: a declaration within the meaning of § 126b BGB, in particular an email or a message in the customer panel.

3 Conclusion of contract, customer account

3.1 The presentation of plans on our website is not a binding offer but an invitation to order.

3.2 To order, the Customer creates a customer account, chooses the Service, plan, location and term, and checks their details on a summary page on which input errors can be recognised and corrected. By clicking the order button (“Order with obligation to pay” or equivalent), the Customer submits a binding offer.

3.3 The contract is concluded when we confirm the order in text form or make the Service available, whichever happens first. An automatic acknowledgement of receipt is not an acceptance.

3.4 We may decline an order without giving reasons, in particular where there are indications of abuse, false information or outstanding claims, or where no capacity is available at the chosen location. Any amount already paid will be refunded in full.

3.5 The Customer must provide true and complete information when registering and keep it up to date, in particular their email address, to which we send legally relevant notices. Consumers must be of legal age.

3.6 Each person may hold a customer account only in their own name. The customer account is not transferable; transferring a Service to a third party requires our consent in text form.

3.7 We store the contract text (order data and these Terms). The Customer can view the order data in the customer panel; these Terms are available in their current version on our website, where they can be saved and printed. The contract language is English.

4 Our services

4.1 The scope and features of the Services are set out in the service description of the chosen plan at the time of ordering (the plan overview on our website and in the ordering process) and in these Terms.

4.2 We provide the Services on our own or rented server infrastructure in the data centre assigned to the location chosen when ordering. We will not move a Service to another country without the Customer’s consent, except in an emergency to avert imminent data loss, of which we will inform the Customer without undue delay.

4.3 We owe the provision of the infrastructure and its connection to the internet within the limits of Section 7. We do not owe any particular result of the Customer’s Content, such as reachability from every network, search engine rankings or the functioning of software the Customer installs themselves.

4.4 Unless expressly agreed, the Services do not include:

• Email services (mailboxes, sending or forwarding email). Outgoing connections on port 25 are blocked from within the Services; customers use their own email provider (e.g. authenticated SMTP on other ports).
• Registration or management of domain names. The Customer brings their own domains and configures their DNS themselves.
• Consulting, programming, maintenance of the Customer’s software, or data recovery beyond the backups described in Section 14.

4.5 For domains the Customer connects to a Service, we provide free TLS certificates from Let’s Encrypt once the domain correctly points to the Service. The Customer may install their own certificates. We give no warranty for issuance by third parties.

4.6 We may develop the Services further, update technical components (such as operating system, PHP or database versions) and, with reasonable notice — as a rule at least four weeks — discontinue outdated versions that no longer receive security updates, provided that this does not materially impair the contractually agreed scope of service. We apply security updates without notice.

4.7 We may use third parties to provide the Services, in particular data centre and network operators (subcontractors). Annex 3 applies to the processing of personal data.

4.8 We may change or discontinue free additional features (such as trial periods or preview addresses) at any time.

5 Specific terms for VPS

5.1 A VPS is an isolated container with the resources stated in its plan (CPU cores, memory, storage). The Customer receives administrator (root) rights inside the container and is solely responsible for its operation, configuration and security, in particular operating system updates, firewall rules inside the VPS, strong passwords and SSH keys.

5.2 Unless the plan states otherwise, CPU cores are shared with other customers on the same physical server. Memory and storage are available within the limits of the plan.

5.3 Traffic: each plan includes the monthly transfer volume stated in its service description (incoming and outgoing traffic combined, per calendar month in UTC). Once it is reached, the VPS’s connection is throttled to 10 Mbit/s until the end of that calendar month; the VPS remains reachable. The throttle is lifted with the new month or upon an upgrade to a plan with a higher volume. For plans with “unlimited” transfer, Section 6.5 applies accordingly.

5.4 IP addresses: depending on the plan and availability, a VPS is reachable either through the server’s public IPv4 address with its own SSH port or through a dedicated public IPv4 address. IP addresses remain the property of NorthVault or the network operator; there is no entitlement to a particular address. Where technically or legally necessary, we may change an address with reasonable prior notice.

5.5 Backups: we create a backup of every VPS daily and retain it for as long as the plan states (for example 7, 14 or 30 days). The Customer can switch off the daily backup in the customer panel. Section 14 applies.

5.6 Outgoing connections on port 25 and the operation of open mail relays, open proxies and open DNS resolvers are prohibited from within a VPS (see Annex 1).

5.7 We access the contents of a VPS only to the extent necessary to provide the Service, to avert a danger to our infrastructure or to third parties, on the Customer’s instructions, or where required by law.

6 Specific terms for web hosting

6.1 A website runs on a server shared by several customers. Each website has its own system user separated from other websites, its own storage, its own PHP processes or application and its own databases within the limits of its plan. There is no command-line (shell/SSH) access to the server.

6.2 Files reach a website through the customer panel (upload, file manager, deployment from Git) or — if the Customer switches it on for a website — through SFTP. SFTP is off by default; once on, only that website’s own folder is accessible. The Customer manages access credentials (passwords and keys) in the customer panel; we do not store passwords in plain text.

6.3 Databases (MariaDB) can be reached only from the website’s own code, not from the internet. The number of databases and database users depends on the plan and its service description.

6.4 Resources: storage, memory and computing time are limited per website by its plan and technically enforced. Once a website reaches its storage limit, no further data can be stored, which may cause errors on the website.

6.5 “Unlimited” traffic (fair use): web hosting plans are offered with unlimited traffic for normal use as a website. If a website’s traffic exceeds 10 TB in a calendar month (UTC, incoming and outgoing combined), its connection is throttled to 1 Mbit/s until the end of that calendar month; the website remains reachable. The throttle is lifted with the new month. Normal use does not include, in particular, providing large files for mass download, media streaming as the main purpose, file hosting for third parties, or use as download or backup storage.

6.6 Backups: with every deployment (uploading a version, Git deployment, WordPress installation), we keep the files and a backup of all the website’s databases; the most recent versions are retained and older ones deleted automatically. Databases are additionally backed up nightly unless the Customer switches this off, and retained for the period stated in the customer panel. Section 14 applies.

6.7 The Customer is responsible for applications installed through the customer panel (such as WordPress) and their extensions, including updates and secure configuration. Convenience features we offer (such as automatic updates or security checks) do not release the Customer from this responsibility.

6.8 A staging copy of a website is a separate, password-protected copy for testing and counts towards the website’s resources.

7 Availability, maintenance, incidents

7.1 We operate the infrastructure with the care of a prudent business according to the state of the art and endeavour to keep it available without interruption. A specific availability (such as an annual percentage) is owed only if it is expressly promised for the plan.

7.2 The following do not count as downtime: interruptions due to announced maintenance, necessary security measures, force majeure (Section 19), disruptions outside our sphere of influence (such as in the internet beyond our network operator), and acts or Content of the Customer.

7.3 We announce maintenance that causes interruptions, where possible, at least 24 hours in advance in the customer panel or by email and schedule it, where possible, at low-traffic times. Urgent security measures (such as a restart after a critical security update) may take place without notice.

7.4 The Customer reports incidents through the customer panel or to our support with as precise a description as possible. We begin remedying them within a reasonable period.

8 Customer obligations

8.1 The Customer uses the Services only in accordance with the law, these Terms and the Acceptable Use Policy (Annex 1). The Customer is responsible for all Content stored or distributed through their Services, including Content posted by third parties (such as users of their website or persons they engage).

8.2 The Customer keeps access credentials (passwords, SSH keys, database and SFTP credentials, API keys) secret, chooses strong passwords and, where offered, additionally protects the customer account (e.g. with two-factor authentication). If misuse is suspected, the Customer changes the credentials without undue delay and informs us. Actions taken with the Customer’s credentials are attributed to the Customer unless the Customer is not responsible for the misuse.

8.3 The Customer keeps software they operate (the operating system of a VPS, content management systems, plugins, libraries) up to date and supported by security updates, and remedies known security vulnerabilities without undue delay.

8.4 The Customer backs up their Content regularly and independently outside NorthVault’s services, at the latest before every material change (see Section 14). Our backups do not replace the Customer’s own.

8.5 The Customer keeps their contact details up to date, in particular their email address, and checks messages sent to it at reasonable intervals.

8.6 The Customer uses resources only within the limits of their plan and does not burden the infrastructure in a way that affects other customers (e.g. through attacks, mass mailing or sustained overload). Load tests and security tests against their own Services that may affect other customers must be announced to us in advance.

8.7 Where the Customer processes personal data of third parties (such as visitors to their website), the Customer is the controller under data protection law and responsible in particular for privacy notices, legal bases and consents. Annex 3 applies to businesses; consumers who process data solely for personal or household activities are not subject to the GDPR in this respect.

8.8 The Customer provides the legally required information (such as a legal notice / imprint) on offerings they operate, where they are obliged to do so.

9 Acceptable Use Policy

9.1 The Acceptable Use Policy in Annex 1 applies to the use of all Services and specifies which Content and uses are prohibited.

9.2 A breach of the Acceptable Use Policy is a breach of a material contractual obligation and entitles us to take the measures under Section 10.

10 Abuse reports, suspension

10.1 We receive reports of illegal Content or abuse at abuse@northvault.com and examine them promptly, diligently and objectively. We handle notices under the Digital Services Act (Regulation (EU) 2022/2065, “DSA”) in accordance with its requirements: we inform the notifier of our decision and the Customer of any measure taken against their Content, with a statement of reasons and available redress.

10.2 If we become aware of indications of a breach, we inform the Customer in text form, as a rule give them a reasonable period to respond and remedy the breach, and state the reason. If the breach is not remedied, we may disable access to the Content concerned or suspend the Service concerned.

10.3 We may suspend, disconnect or throttle a Service in whole or in part without prior notice if:

• it poses a present danger to our infrastructure, other customers or third parties, in particular through attacks, malware, phishing, spam or compromised systems;
• Content is manifestly illegal, in particular child sexual abuse material, terrorist content, or Content whose distribution constitutes a criminal offence;
• an authority or court orders it;
• the Customer is in payment default to an extent that justifies suspension under Section 11.6.

10.4 A suspension is limited, where possible, to the Service or part of the Service concerned and is lifted as soon as the reason no longer applies. The obligation to pay charges continues during a suspension for which the Customer is responsible.

10.5 We may block network ranges from which attacks on our infrastructure demonstrably originate from accessing our Services.

10.6 In the event of serious or repeated breaches, we may terminate the contract for cause (Section 12.8). Statutory obligations to disclose information to authorities remain unaffected.

11 Prices, payment, credit balance, default

11.1 The prices stated at the time of contract conclusion apply. They are final prices. NorthVault is a small business within the meaning of § 19 of the German VAT Act (UStG) and therefore does not charge VAT; invoices show no VAT. Should VAT become payable in future, we will inform the Customer in text form before it applies; prices for consumers then remain final prices including VAT, and for businesses VAT is added to the net price, subject to Section 20.3.

11.2 Charges for the initial term are payable in advance when it begins; after the initial term, charges are payable monthly in advance. We charge no setup fees unless expressly stated.

11.3 Payment is made from the credit balance of the customer account or by the payment methods offered in the ordering process. The Customer may top up their credit balance in advance; charges due are deducted from it. Credit balances bear no interest and cannot be transferred to third parties.

11.4 Upon termination of all contracts and closure of the customer account, we refund any unused credit balance at the Customer’s request to the original payment method or to an account named by the Customer. Credits we granted without consideration (such as promotional credit) are not paid out.

11.5 We issue invoices electronically and make them available in the customer panel. The Customer agrees to electronic invoices; businesses for whom a structured electronic invoice is legally required receive one.

11.6 If the Customer is in default of payment, the statutory rules apply. If the Customer is in default with a not insignificant amount for more than 14 days, we may suspend the Service concerned after prior warning in text form with a notice period of at least two weeks; for consumers, an amount is not insignificant if it equals at least one month’s charge. If a Service is not renewed when due because the credit balance is insufficient, Section 12.5 applies.

11.7 Chargebacks or return debits for which the Customer is responsible entitle us to claim the costs incurred; the Customer may prove that a lower loss was incurred.

11.8 The Customer may set off only claims that are undisputed, finally established by a court, or reciprocal to our claims. A business may assert a right of retention only on the basis of the same contractual relationship.

11.9 The Customer raises objections to a statement in text form within eight weeks of receipt; afterwards the statement is deemed approved. We point out this consequence on the invoice. The Customer’s statutory claims in the event of justified later objections remain unaffected.

12 Term, renewal, termination, plan changes

12.1 Each Service is contracted for the initial term chosen when ordering (one, twelve or twenty-four months). The term begins when the Service is made available.

12.2 Unless it is terminated by the end of the initial term, the contract then continues month by month at the plan’s monthly price. From then on, the Customer may terminate it at any time with effect from the end of the current month.

12.3 During the initial term, ordinary termination takes effect at the end of the initial term. For consumers, the notice period never exceeds one month once the initial term has ended (§ 309 No. 9 BGB).

12.4 The Customer terminates in the customer panel (“Cancel contract” on the Service concerned), through the “Cancel contracts here” button that is reachable from every page of our website without logging in (§ 312k BGB), or in text form. We confirm receipt of the termination immediately on screen and confirm it in text form without undue delay, stating when it takes effect. The Customer may withdraw a termination in the customer panel until the Service is deleted.

12.5 When the contract ends, the Service is stopped (VPS) or taken offline (website). 14 days after the contract ends, the Service and all its Content, including our backups, are irrevocably deleted (see Section 13).

12.6 An upgrade to a higher plan is possible at any time and takes effect immediately; the price difference for the remaining term is charged pro rata. A downgrade to a lower plan takes effect at the end of the current term and only if the Content fits within the resources of the lower plan.

12.7 We may terminate a contract with one month’s notice, at the earliest to the end of the initial term. We refund charges paid in advance for the period after the contract ends.

12.8 Both parties’ right to terminate for cause remains unaffected. Cause exists for us in particular if the Customer seriously or, despite a warning, repeatedly breaches these Terms or the Acceptable Use Policy, provided false information when registering, is in default of payment of charges for more than two months, or uses the Services to commit criminal offences. In the event of a termination for cause for which the Customer is responsible, we refund charges already paid only to the extent they exceed our expenses and claims incurred up to then.

12.9 If the Customer closes their customer account, it ends once all contracts have ended and all claims have been settled.

13 End of contract, return and deletion of data

13.1 Until the contract ends, the Customer can download and export their Content at any time (e.g. via SFTP, the file manager, database exports or the backups in the customer panel). The Customer is responsible for doing so in good time before the contract ends.

13.2 Within 14 days after the contract ends, the Customer may ask us to make the stopped Service available once more so they can download their data; for a VPS, the Customer may instead request the latest existing backup. Thereafter, all Content of the Service, including our backups, is irrevocably deleted.

13.3 Statutory retention obligations (such as for invoices and accounting records) remain unaffected; we restrict the affected customer account data and delete it after the retention periods expire.

13.4 We have no right to retain Content after the contract ends unless the Content is subject to an order of an authority or court.

14 Backups

14.1 The backups described in Sections 5 and 6 are an additional service to reduce data loss. They are currently stored in the same data centre as the Service and therefore do not protect against every incident (such as a total failure of the data centre). A backup at another location is owed only if it is expressly promised for the plan.

14.2 We do not guarantee that a backup exists for a particular point in time, is complete or can be restored, in particular if the Customer has switched off backups, Content was changed during the backup, or a Service has reached its storage limit.

14.3 The Customer must back up their Content independently, regularly and outside NorthVault’s infrastructure, and verify that it can be restored. The Customer backs up databases in a format that can be restored without access to our Services.

14.4 The Customer performs restores from our backups in the customer panel. Before every restore that overwrites database content, we create a backup of the previous state.

15 Data protection, confidentiality

15.1 We process the Customer’s personal data (master, contract, payment and usage data) in accordance with data protection law, in particular the GDPR. Details are set out in our Privacy Policy. The Customer can direct data protection questions to privacy@northvault.com.

15.2 Where we process personal data on the Customer’s behalf as part of the Services (such as data of visitors to their website or data stored in their VPS), the Data Processing Agreement in Annex 3 applies. It takes effect upon conclusion of the contract without a separate signature.

15.3 We treat the Customer’s Content as confidential, do not analyse it for our own purposes, and disclose it only if the Customer requests it, if necessary to provide the Services (Annex 3), or if we are obliged to by law or by an order of an authority or court. We inform the Customer of such an obligation where legally permitted.

15.4 To defend against attacks and for billing, we record technical usage data (such as transferred data volumes, resource consumption, connection and error logs) and retain it only as long as necessary for these purposes.

16 Defects

16.1 The statutory rights in respect of defects apply. For consumers, §§ 327 et seq. BGB apply to digital services in particular, including the obligation to provide necessary updates.

16.2 The Customer reports defects without undue delay through the customer panel or to our support and reasonably assists us in remedying them.

16.3 Towards businesses, strict liability for defects already present at the time of contract conclusion (§ 536a(1), first alternative, BGB) is excluded. A business may claim a price reduction only if a defect materially impairs the usability of the Service for more than 24 consecutive hours.

17 Liability

17.1 We are liable without limitation for intent and gross negligence, for injury to life, body or health, under the German Product Liability Act, and to the extent of any guarantee we have given.

17.2 In cases of slight negligence, we are liable only for breach of a material contractual obligation, i.e. an obligation whose fulfilment makes the proper performance of the contract possible in the first place and on whose fulfilment the Customer may regularly rely (cardinal obligation). In this case, liability is limited to the damage typical for the contract and foreseeable at the time of contract conclusion.

17.3 Towards businesses, liability under Section 17.2 is limited per incident to the charges the Customer paid for the Service concerned in the twelve months before the incident, but no more than EUR 5,000; liability for lost profits is excluded to this extent.

17.4 We are liable for loss of data only to the extent that would have been required for recovery had the Customer backed up their data properly, regularly and in line with the risk (Sections 8.4 and 14.3).

17.5 Otherwise, liability is excluded. These limitations also apply in favour of our legal representatives, employees and vicarious agents.

17.6 We are not liable for the Customer’s Content and do not adopt it as our own. The liability exemptions for intermediary services under the Digital Services Act remain unaffected.

18 Indemnity

18.1 The Customer indemnifies us against all claims asserted against us by third parties because of an unlawful use of the Services for which the Customer is responsible or because of the Customer’s Content, including reasonable costs of legal defence at the statutory rates.

18.2 We inform the Customer of such claims without undue delay and give them an opportunity to comment. We make acknowledgements or settlements only after consulting the Customer, unless consultation is unreasonable.

19 Force majeure

19.1 Neither party is liable for failure to perform its obligations to the extent that this is due to events beyond its reasonable control whose consequences could not have been averted even with reasonable care, such as natural disasters, war, terrorism, pandemics, official orders, widespread power or network failures, strikes at third parties, or attacks that succeed despite protective measures in line with the state of the art.

19.2 If such an event lasts longer than 30 days, either party may terminate the affected contract for cause. We refund pro rata any charges paid in advance for the period in which the Service was not provided.

20 Changes to these Terms, the Services and prices

20.1 We may amend these Terms where there is a valid reason, in particular changes in legislation or case law, new technical developments, new services, or to close gaps that have arisen subsequently, provided that the balance between performance and consideration is not shifted to the Customer’s detriment.

20.2 We notify the Customer of amendments in text form at least six weeks before they take effect and set out the changes. Businesses: if the Customer does not object in text form within this period, the amendments are deemed approved; we point out this consequence specifically in the notice. Consumers: amendments take effect only if the consumer agrees to them, for example by confirming in the customer panel. If the consumer does not agree, the previous Terms continue to apply; we may then terminate the contract under Section 12.7.

20.3 Price changes apply only to future terms. We notify businesses at least six weeks in advance; a business may terminate the affected contract with effect from the date the change takes effect. Towards consumers, price increases take effect only with their express consent. We pass on price reductions to all customers.

20.4 Changes to Services under Section 4.6 remain unaffected.

21 Right of withdrawal for consumers

Consumers have a right of withdrawal as follows:

Withdrawal notice

Right of withdrawal: You have the right to withdraw from this contract within fourteen days without giving any reason. The withdrawal period will expire after fourteen days from the day of the conclusion of the contract.

To exercise the right of withdrawal, you must inform us ([Company name] [Legal form, e.g. GmbH], [Street and number], [Postcode and city], Germany, email: legal@northvault.com, phone: [Phone number]) of your decision to withdraw from this contract by an unequivocal statement (e.g. a letter sent by post or an email). You may use the attached model withdrawal form (Annex 2), but it is not obligatory. To meet the withdrawal deadline, it is sufficient for you to send your communication concerning your exercise of the right of withdrawal before the withdrawal period has expired.

Effects of withdrawal: If you withdraw from this contract, we shall reimburse to you all payments received from you, including the costs of delivery (with the exception of the supplementary costs resulting from your choice of a type of delivery other than the least expensive type of standard delivery offered by us), without undue delay and in any event not later than fourteen days from the day on which we are informed about your decision to withdraw from this contract. We will carry out such reimbursement using the same means of payment as you used for the initial transaction, unless you have expressly agreed otherwise; in any event, you will not incur any fees as a result of such reimbursement.

If you requested to begin the performance of services during the withdrawal period, you shall pay us an amount which is in proportion to what has been provided until you have communicated to us your withdrawal from this contract, in comparison with the full coverage of the contract.

End of withdrawal notice

Note: because Services are provided immediately after ordering, we ask consumers in the ordering process to expressly request that we begin performance before the withdrawal period expires. The right of withdrawal expires when we have fully performed the service and began performance only after the consumer gave their express consent and at the same time acknowledged that they lose their right of withdrawal once the contract has been fully performed.

22 Communication

22.1 We usually communicate with the Customer by email to the address stored in the customer account and through the customer panel. Notices are deemed received when they can be accessed under normal circumstances.

22.2 Declarations to be made in text form under these Terms may be made by email or through the customer panel.

22.3 We never ask for access credentials (passwords) by email or phone.

23 Consumer dispute resolution

We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board (§ 36 of the German Consumer Dispute Resolution Act, VSBG). For questions and complaints, customers contact our support; we strive for an amicable solution.

24 Assignment, transfer of the contract

24.1 The Customer may transfer rights and obligations under the contract to third parties only with our prior consent in text form. § 354a of the German Commercial Code (HGB) remains unaffected.

24.2 We may transfer the contract to an affiliated company or a legal successor with six weeks’ notice. In that case, the Customer may terminate the contract with effect from the date of the transfer; we point this out in the notice.

25 Final provisions

25.1 The laws of the Federal Republic of Germany apply, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). For consumers, this choice of law applies only insofar as it does not deprive them of the protection afforded by mandatory provisions of the law of the country in which they have their habitual residence.

25.2 If the Customer is a merchant, a legal entity under public law or a special fund under public law, or has no general place of jurisdiction in Germany, the exclusive place of jurisdiction for all disputes arising from the contract is our registered office ([Postcode and city]). We may also sue at the Customer’s general place of jurisdiction.

25.3 Should individual provisions of these Terms be or become invalid, the validity of the remaining provisions remains unaffected. The invalid provision is replaced by the statutory provision.

25.4 These Terms are drawn up in English. Any translations we may provide are for information only; the English version prevails.

Annex 1 Acceptable Use Policy

This policy applies to all Services and to all Content stored, processed or distributed through them. It protects our infrastructure, our customers and the internet. Breaches lead to measures under Section 10 of the Terms.

1. Illegal Content. Content and uses that violate applicable law at the location of the Service, in Germany, or in the country the offering is aimed at are prohibited, in particular:

• child sexual abuse material and any form of its distribution; we report such cases to the competent authorities;
• terrorist content, incitement to violence or hatred, and symbols of unconstitutional organisations, insofar as these are criminal offences;
• Content infringing third-party rights, in particular copyright, trademark, personality and data protection rights (such as unauthorised distribution of films, music or software, or doxing);
• offering and trading prohibited goods and services (such as narcotics, weapons without a permit, forged documents, stolen data);
• illegal gambling and Content violating youth protection laws;
• fraudulent offers, pyramid schemes and deceptive business models.

2. Malware and attacks. In particular, the following are prohibited:

• distributing, hosting or controlling malware (viruses, trojans, ransomware, botnets, command-and-control servers);
• phishing, fake shops and imitating third-party websites or brands to deceive;
• attacks on other systems: denial of service, brute-force login attempts, exploiting vulnerabilities, unauthorised port and vulnerability scans, IP or email spoofing;
• circumventing protective measures and accessing third-party data or services without authorisation — including other customers and NorthVault’s infrastructure.

3. Spam and network abuse. In particular, the following are prohibited:

• sending unsolicited bulk or advertising messages (spam) through the Services, or promoting Services through spam even if sent elsewhere;
• operating open mail relays, open proxies, open DNS resolvers or other open services that can be misused to amplify attacks;
• operating Tor exit nodes and public VPN exits without our prior consent in text form;
• manipulating routing or address information.

4. Resources and fair use. Uses that excessively and persistently burden the infrastructure or affect other customers are prohibited, in particular:

• cryptocurrency mining and persistent full load of shared CPU cores without prior consent;
• on web hosting: file hosting, download archives, backup storage for other systems, and media streaming as the main purpose (see Section 6.5 of the Terms);
• methods that deliberately circumvent limits and measurements (such as traffic or resource limits).

5. Security. The Customer adequately protects their Services against misuse by third parties. A compromised Service from which attacks or spam originate is taken offline until the Customer has cleaned it up.

6. Reports. Breaches can be reported at any time to abuse@northvault.com. A report should state the affected address (URL, IP, time with time zone), a description and — for infringements — the rights infringed. We do not process manifestly abusive reports.

7. Cooperation with authorities. We cooperate with law enforcement authorities within the limits required by law. We disclose information only on the basis of a legal obligation or order.

Annex 2 Model withdrawal form

(Complete and return this form only if you wish to withdraw from the contract.)

To: [Company name] [Legal form, e.g. GmbH], [Street and number], [Postcode and city], Germany, email: legal@northvault.com

• I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract for the provision of the following service (*): …
• Ordered on (*) / received on (*): …
• Name of consumer(s): …
• Address of consumer(s): …
• Signature of consumer(s) (only if this form is notified on paper): …
• Date: …

(*) Delete as appropriate.

Annex 3 Data Processing Agreement (Art. 28 GDPR)

This agreement applies to the extent that NorthVault processes personal data on the Customer’s behalf as part of the Services. The Customer is the controller; NorthVault is the processor.

1. Subject matter, duration, nature and purpose. The subject matter is the provision of storage and computing capacity (VPS, web hosting) including backups. Nature of processing: storage, transmission, backup, restoration and deletion. The sole purpose is the provision of the Services ordered by the Customer. This agreement applies for the duration of the respective contract and thereafter until the data is deleted under Section 13 of the Terms.

2. Types of data and categories of data subjects. Which data is processed is determined solely by the Customer through the Content they bring into their Services. This may include, in particular, master, contact, contract, usage and content data of the Customer’s customers, prospects, website visitors, employees and business partners. The processing of special categories of data (Art. 9 GDPR) is the Customer’s responsibility, who takes appropriate additional measures themselves.

3. Instructions. NorthVault processes the data only on documented instructions from the Customer, given through the contract, the settings in the customer panel and instructions in text form, unless NorthVault is required to process it by Union or Member State law; in that case NorthVault informs the Customer of that legal requirement before processing, unless that law prohibits it. If NorthVault considers an instruction unlawful, it informs the Customer.

4. Confidentiality. NorthVault uses only persons who have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

5. Technical and organisational measures (Art. 32 GDPR). NorthVault takes appropriate measures, at least: physical access control through the data centre’s security measures; separation of customers by containers or separate system users with their own permissions; access to administrative interfaces only through encrypted connections restricted to authorised systems and with keys instead of passwords; encrypted transmission (TLS, SFTP); storage of passwords only as hashes; firewalls and limits against attacks; logging of administrative actions; daily backups under Sections 5, 6 and 14 of the Terms; regular security updates. NorthVault may adapt the measures to the state of the art provided the level of protection is not reduced.

6. Sub-processors. The Customer authorises the use of the operators of the data centres and networks at the locations of their Services and of the providers NorthVault uses to operate and administer the platform. NorthVault provides the current list on request and on its website. NorthVault informs the Customer of intended changes at least four weeks in advance; the Customer may object for an important data protection reason and, if no agreement is reached, terminate the affected contracts with effect from the date of the change. NorthVault contractually binds sub-processors to the obligations of this agreement. Processing outside the EU and EEA takes place only if the Customer chooses a location outside it or the requirements of Art. 44 et seq. GDPR are met.

7. Assistance. NorthVault assists the Customer with appropriate measures in responding to data subject requests, ensuring the security of processing, notifying personal data breaches, data protection impact assessments and prior consultations, insofar as the information is not available to the Customer through the customer panel. For assistance beyond the functions of the customer panel, NorthVault may charge a reasonable fee unless the assistance is caused by a breach on NorthVault’s part.

8. Personal data breaches. NorthVault informs the Customer without undue delay after becoming aware of a personal data breach within its area of responsibility, with the information the Customer needs for a notification under Art. 33 GDPR.

9. Deletion and return. After the contract ends, NorthVault proceeds under Section 13 of the Terms: the Customer can export their data themselves until the contract ends and within the period stated there; thereafter NorthVault deletes it, including backups, unless there is a legal obligation to retain it.

10. Evidence and audits. NorthVault provides the Customer with the information necessary to demonstrate compliance with this agreement and allows audits by the Customer or an auditor appointed by the Customer and bound to confidentiality, after timely notice — as a rule four weeks in advance — during normal business hours and without disrupting operations. Evidence may also be provided through suitable certifications or audit reports by independent bodies. The Customer bears the costs of an on-site audit unless it reveals a material breach by NorthVault.

11. Liability. Art. 82 GDPR applies to liability; otherwise Section 17 of the Terms applies.