*Note: This English version is provided for convenience. The German version is the legally binding version.*
1. Scope and Conclusion of Contract
1.1 These GTC govern the provision of the software "PSA Verify" (the "Platform") for the digital management and inspection of radiation protection equipment as Software-as-a-Service. The offering is directed exclusively at entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB), legal entities under public law and special funds under public law (the "Customer"); no sales are made to consumers.
1.2 The contract is concluded upon the Provider's acceptance of the order or countersignature of the order form. The Provider's offers are non-binding; the Provider may decline orders without stating reasons. Deviating or supplementary terms of the Customer do not become part of the contract, even if the Provider does not expressly object to them.
2. Services of the Provider
2.1 The Provider makes the Platform available to the Customer for use via the internet for the term of the contract. The Platform is a web-based SaaS solution for the management, inspection and documentation of radiation protection equipment and is aimed in particular at hospitals, medical care centers, medical practices and medical technology departments. The functional scope results from the service description in its current version; the booked scope results from the order form.
2.2 The Platform comprises in particular the following modules: Monitor (read-only access to data and reports), Inventory (management of PPE inventories, maintenance of master data, lifecycle management) and Audit (performance of standards-based inspections with detailed documentation including photographic evidence and the generation of inspection reports in PDF format).
2.3 Licensing is based exclusively on the number of active PPE items; the number of users, sites and departments is not limited. Data entry is possible at any time; the license check takes place upon completion of an inspection period. If the licensed number of active PPE items is exceeded, completion of the inspection is blocked and no inspection report is generated until the Customer extends the license or reduces the active inventory accordingly.
2.4 The Platform enables the export of data and inspection reports in selected formats (in particular Excel and print-optimized PDF files). There is no entitlement to specific export formats or interfaces; API interfaces and further integrations are planned prospectively but are not owed.
2.5 Included are operation and hosting in a data center in Germany, ongoing updates and security patches, daily data backups, support in accordance with Section 5, and remote onboarding of up to two hours. The handover point for the services is the internet gateway of the data center used; the Customer's internet connection and end devices are not part of the contract.
2.6 The Provider may use subcontractors to perform the services (in particular the software developer Pelephant GmbH, the hosting provider IONOS SE and the e-mail service Resend); the processing of personal data is governed by the data processing agreement (Section 7).
2.7 The Provider may further develop and modify the Platform provided that the contractually agreed core functional scope is maintained and the change is reasonable for the Customer.
3. Usage Rights
3.1 For the term of the contract, the Customer receives the non-exclusive, non-transferable and non-sublicensable right to use the Platform within the booked scope for its own business purposes.
3.2 Access credentials must be kept confidential. The Customer ensures that each natural person works only with their own user account and reports any suspected misuse without undue delay.
3.3 In particular, making the Platform available to third parties outside the Customer's own business, the systematic extraction of data, and any abusive or unlawful use are prohibited. Mandatory statutory rights (Sections 69d, 69e of the German Copyright Act) remain unaffected.
4. Availability
4.1 The Provider warrants availability of the Platform of 99.5% on a monthly average at the handover point. Excluded are announced maintenance windows (as a rule outside business hours, announced at least 3 business days in advance, a maximum of 4 hours per month), outages due to force majeure, and causes within the Customer's sphere of responsibility.
4.2 The Platform's offline functionality allows inspections that have been started to be continued during unavailability; recorded data is synchronized once the connection is restored.
5. Support and Service Levels
Support hours: Monday to Friday, 08:00–17:00 (public holidays in Hesse excluded). Reports by e-mail to support@psaverify.de. Response and resolution times run only within support hours; resolution targets are target values.
| Priority | Definition | Response time | Resolution target |
|---|---|---|---|
| P1 – critical | Platform unreachable or a central function unusable; no workaround | 1 business day | Workaround within 2 business days; final resolution as quickly as possible |
| P2 – high | Essential function significantly impaired | 2 business days | 5 business days |
| P3 – medium | Impairment with a reasonable workaround | 3 business days | next update |
| P4 – low | Minor defects, application questions | 5 business days | scheduling in roadmap |
6. Duties of the Customer
6.1 The Customer shall (a) provide truthful information upon registration and keep it up to date; (b) keep access credentials safe; (c) check the content it enters for lawfulness and remain responsible for it; (d) cooperate in fault analysis by providing comprehensible error reports; (e) regularly export its data via the export functions provided, insofar as it is subject to its own retention obligations.
6.2 Use of the Platform does not release the Customer from its statutory obligations, in particular its responsibility for the proper and timely performance of the prescribed inspections of radiation protection equipment (for example in accordance with DIN 6857-2). The Platform is a tool for management and documentation.
6.3 As the data controller, the Customer is responsible for ensuring that the introduction and use of the Platform in its organization is carried out lawfully, in particular with regard to the processing of employee data (Section 26 of the German Federal Data Protection Act, BDSG), informing employees (Art. 13 GDPR) and any co-determination rights of the works council or staff council.
7. Data Protection and Data Security
7.1 The Customer remains the controller for the personal data processed on the Platform (in particular data of its employees and inspection data). The Provider processes this data exclusively as a processor on the Customer's instructions.
7.2 The parties conclude the data processing agreement (DPA) pursuant to Art. 28 GDPR; it forms part of the contract and takes precedence over these GTC in the area of data protection. Approved sub-processors are Pelephant GmbH (Zurich, Switzerland — adequacy decision of the European Commission), IONOS SE (Munich, Germany) and Plus Five Five, Inc. ("Resend", USA — EU-U.S. Data Privacy Framework, supplemented by Standard Contractual Clauses).
7.3 The Provider implements technical and organizational measures appropriate to the risk (including transport encryption, role-based access, tenant separation, logging of write operations, daily backups).
7.4 The Provider may use anonymized usage data that cannot be traced back to individuals or the Customer to improve the Platform.
8. Remuneration and Payment Terms
8.1 The remuneration is based on the booked tier of active PPE items in accordance with the order form or the current price list. Billing takes place monthly or annually in advance in accordance with the billing period agreed in the order form; prices are exclusive of statutory VAT.
8.2 Payment term: 30 days net. In the event of default in payment, the Provider may block access after a reminder with a 10-day grace period; the payment obligation remains. The statutory consequences of default (Sections 286, 288 BGB) remain unaffected.
8.3 Price adjustments are announced in text form at least 3 months in advance and take effect at the earliest from the next renewal period. If the Customer does not agree to an increase, it may terminate the contract extraordinarily with effect from the date the increase takes effect; this will be pointed out in the announcement.
9. Warranty
9.1 The statutory warranty provisions of German tenancy law apply to the provision of the Platform. The Provider's strict (no-fault) liability for defects already existing at the time of conclusion of the contract (Section 536a (1) alt. 1 BGB) is excluded.
9.2 Defects are remedied within the framework of Section 5. No warranty exists for faults outside the Provider's sphere of responsibility (in particular the Customer's internet connection and end devices) or for the substantive accuracy of the data entered by the Customer.
10. Liability
10.1 The Provider is liable without limitation for intent and gross negligence, for damage arising from injury to life, body or health, under the German Product Liability Act, and to the extent of a guarantee it has assumed.
10.2 In the event of a slightly negligent breach of a material contractual obligation — i.e., an obligation whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the Customer may regularly rely — liability is limited to the damage typical for the contract and foreseeable at the time of conclusion of the contract; as a rule, this corresponds at most to the remuneration paid by the Customer in the twelve months preceding the damaging event. In all other respects, liability for slight negligence is excluded.
10.3 In the event of loss of data, the Provider is liable within the scope of the preceding paragraphs only for the effort required to restore the data from the backups provided for in the contract.
10.4 Any further liability of the Provider is excluded. In particular, the Provider is not liable for force majeure or for faults and damage whose cause lies outside its sphere of responsibility (in particular the Customer's internet connection and end devices, or operating errors). The Provider implements appropriate technical and organizational measures to protect the data; however, complete protection against cyberattacks cannot be guaranteed. For damage resulting from such third-party attacks, the Provider is liable only in accordance with Sections 10.1 to 10.3.
10.5 Claims under Section 10.2 become time-barred within twelve months of the commencement of the statutory limitation period; in the cases of Section 10.1, the statutory limitation periods apply.
10.6 The above limitations also apply in favour of the Provider's legal representatives, employees and vicarious agents.
11. Confidentiality
The parties shall treat the other party's confidential information as confidential, use it only for the performance of the contract, and disclose it only to persons bound by corresponding obligations. This obligation continues for 3 years after the end of the contract. Statutory disclosure obligations remain unaffected.
12. Term and Termination
12.1 The contract begins on the date stated in the order form, has a minimum term of 12 months and is extended by successive periods of 12 months unless terminated in text form with 3 months' notice to the end of the then-current term. The renewal is expressly pointed out in the order form.
12.2 The right to extraordinary termination for good cause (Section 314 BGB) remains unaffected.
13. Provider Switching, Data Portability and End of Contract
13.1 The Customer may switch to another provider or to its own IT infrastructure at the end of the contract or upon request at any time. The Provider shall reasonably support the Customer and third parties authorized by it in the switching process, carry it out without undue delay, and work towards maintaining business continuity.
13.2 The Provider shall make a list of the transferable data categories available to the Customer in text form upon request. The integrity and availability of the data shall not be impaired during the switching process.
13.3 After the end of the contract, the Provider shall make the Customer's data available for export in a common, structured and machine-readable format for a retrieval period of 30 calendar days. After expiry of this period, the data will be completely deleted unless statutory retention obligations exist; backup copies are overwritten in the ordinary cycle. Details are governed by the DPA.
13.4 For switching support that goes beyond the provision of the export functions, the Provider may charge a reasonable fee to the extent permitted by law; the Customer will be informed in advance.
14. Amendments to these GTC
The Provider may amend these GTC with effect for the future to the extent reasonable for the Customer. Amendments are communicated in text form at least 2 months before they take effect. If the amendments materially worsen the Customer's legal position, the Customer may terminate the contract with effect from the date the amendments take effect; this will be pointed out in the notification.
15. Final Provisions
15.1 The transfer of rights under the contract by the Customer requires the Provider's consent (Section 354a of the German Commercial Code remains unaffected). The Provider may transfer the contract in the context of a corporate succession or to an affiliated company; the Customer will be informed.
15.2 Should individual provisions be invalid, the remainder of the contract remains valid.
15.3 The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). The exclusive place of jurisdiction for all disputes arising from or in connection with the contract is Wiesbaden, provided the Customer is a merchant, a legal entity under public law or a special fund under public law.