Supplier Portal Usage Agreement

Version 1.1.0 · effective 2026-05-19

§ 1 Scope and Parties

(1) This Usage Agreement governs the relationship between P&P Unternehmensgruppe Marco Pavlov Pereira (the "Platform Operator") providing the supplier-portal software, and you as a commercial user (the "User"), whether buying organisation ("Buyer") or supplier.

(2) This agreement applies exclusively to commercial users (entrepreneurs within the meaning of § 14 BGB). It is not a consumer agreement.

(3) Any deviating or supplementary general terms of the User do not become part of the contract, even if not expressly objected to.

§ 2 Subject Matter and Clarification of the Platform's Role

(1) The Platform Operator provides a browser-based software-as-a-service solution ("Platform") for managing supplier master data, RFQs, offers, purchase orders and related documents.

(2) The Platform Operator is not a contracting party to the supply or purchase contracts processed via the Platform. Such contracts arise exclusively between Buyer and Supplier; the Platform only provides the tool. The Platform Operator is not liable for the proper performance of these contracts.

(3) The Platform Operator is not the manufacturer of products traded via the Platform. The respective Supplier remains the manufacturer for purposes of the Product Liability Act (ProdHaftG) and Directive 2024/2853.

§ 3 Registration and Account Security

(1) Use of the Platform requires registration. The User confirms that all registration data is true and complete and will keep it up to date.

(2) The User must keep credentials confidential and not share them with third parties. Multi-factor authentication is recommended and may be made mandatory by the Platform Operator for certain functions.

(3) The User must notify the Platform Operator without undue delay of any indication of credential misuse.

(4) Account sharing between multiple natural persons is prohibited.

§ 4 Authority of Representation

(1) On first registration of an organisation, the registering User confirms authority to represent the organisation with binding effect (§§ 164 ff. BGB).

(2) Subsequent users invited by an authorised admin accept this agreement with effect for themselves; the binding of the organisation arises through the first registrant.

§ 5 User Obligations

(1) The User is responsible for the accuracy of data they upload.

(2) The User shall not use the Platform for illegal purposes and shall not upload content infringing third-party rights or confidentiality obligations.

(3) The User complies with the German Trade Secrets Act (GeschGehG) regarding shared third-party information (see § 9).

§ 6 Availability (no committed service level)

(1) The Platform Operator targets 95 % availability per calendar year on average. This is a target, not a warranted property under § 443 BGB. The Platform runs on third-party infrastructure (cloud hosting, database) whose own SLAs do not guarantee 100 % availability; the target above accounts for this dependency.

(2) Maintenance is performed outside business hours where possible. Emergency maintenance may occur at any time.

(3) During temporary outages, the User must transmit time-critical declarations (in particular complaint notices under § 377 HGB) via alternative channels (email, postal). Sending via the Platform is not a prerequisite for preserving statutory deadlines.

§ 7 Liability

(1) The Platform Operator is fully liable for:

• intent and gross negligence;
• injury to life, body or health;
• damage for which mandatory liability under the Product Liability Act applies;
• assumption of a guarantee or procurement risk.

(2) For ordinary negligence, the Platform Operator is liable only for breach of cardinal contractual duties — those whose performance enables the contract in the first place — and limited to the typically foreseeable damage.

(3) Any further liability is excluded.

(4) These limitations also apply to personal liability of employees, legal representatives and vicarious agents of the Platform Operator.

§ 8 Data Protection and Processor Relationship

(1) The Platform Operator processes personal data as a processor under Art. 28 GDPR on behalf of the relevant Buyer organisation. Details are in the Data Processing Agreement (DPA) included as Annex 1.

(2) The Platform Operator will not use customer data for own purposes, in particular not for training own or third-party AI or machine-learning models. Aggregated, irreversibly anonymised statistics remain permissible.

(3) A privacy notice under Art. 13 GDPR is attached as Annex 3 and presented for active confirmation on first login.

§ 9 Confidentiality

(1) The User treats all non-public information of third parties received via the Platform (drawings, specifications, mill certificates, costing bases, trade secrets) as trade secrets within the meaning of GeschGehG.

(2) The User commits to adequate confidentiality measures, including:

• access only by named personnel under confidentiality obligation;
• encrypted storage of sensitive content (at least AES-256 at rest);
• encryption in transit (TLS 1.2 or higher);
• access logging (who, when, what);
• return or documented deletion after contract end;
• imposing equivalent measures on subprocessors.

(3) The confidentiality obligation continues for five years beyond contract end, unless mandatory retention obligations require longer.

§ 10 Intellectual Property and Licence

(1) All content uploaded by the User (drawings, 3D models, mill certs, technical specifications) remains the unrestricted property of the uploading User or its supplier/manufacturer.

(2) The User grants the Platform Operator only a non-exclusive, purpose-bound licence limited to the contract term for storing, processing and displaying such content for the platform service. Sublicensing to third parties beyond contractually required subprocessors is excluded.

(3) Use of uploaded content for training artificial intelligence or building anonymised models is excluded without explicit, separate authorisation.

§ 11 Data Export and Switching (Data Act)

(1) The User may request a structured export of their stored data in machine-readable, common format at any time. The export will be made available within 30 days.

(2) In line with Regulation (EU) 2023/2854 (Data Act, applicable from 12 September 2025), switching/export costs between data-processing services are prohibited from 12 January 2027. Until then, only at-cost charges apply.

(3) Clauses establishing unilateral interpretation, blocking or pricing-change rights in favour of the Platform Operator are void within the meaning of Art. 13 Data Act to the extent unreasonable.

§ 12 AI Functions (AI Act)

(1) The Platform uses rule-based heuristics (e.g. for filename auto-categorisation). These are not AI systems within the meaning of Regulation (EU) 2024/1689 (AI Act).

(2) Should the Platform Operator introduce AI-based functions in the future, it will:

• transparently inform the User (Art. 50 AI Act),
• include a visible UI notice for interactive AI functions,
• mark high-risk AI functions (Annex III) as such and meet the corresponding obligations,
• provide an opt-out for AI-supported analyses where legally permitted.

(3) A current inventory of AI and heuristic functions is maintained in the platform's internal features overview and provided by the Platform Operator on request.

§ 13 Security Updates

The Platform Operator commits to delivering security-critical patches within 72 hours of becoming aware of an exploitable vulnerability, regardless of whether the Platform falls within the Cyber Resilience Act (Regulation (EU) 2024/2847).

§ 14 Term and Termination

(1) This agreement is concluded for an indefinite term.

(2) Either party may terminate with 30 days' notice to the end of a calendar month.

(3) The right to extraordinary termination for cause remains unaffected. Cause includes material breach of data-protection, confidentiality or security obligations; insolvency; persistent payment default.

(4) On termination, the Platform Operator will provide a data export and delete the data 30 days after contract end, subject to mandatory retention obligations.

§ 15 Amendments (Active Consent)

(1) The Platform Operator may amend this agreement with effect for the future. Tacit consent (Schweigensfiktion) is excluded.

(2) Amendments will be announced at least 30 days in advance by mail or email. On next login, the User will be prompted for active consent.

(3) If the User does not consent, they may terminate the agreement extraordinarily with effect from the change date (special termination right). Until consent or termination, the previous version continues to apply; write actions may be limited.

§ 16 Final Provisions

(1) This agreement is governed by German law to the exclusion of the UN Convention on Contracts for the International Sale of Goods (CISG).

(2) The exclusive place of jurisdiction for all disputes is the seat of the Platform Operator, provided the User is a merchant, legal person under public law, or special public-law fund (§ 38(1) ZPO). The Platform Operator may also bring claims at the User's general place of jurisdiction.

(3) Should any provision be or become invalid or unenforceable, the validity of the remaining provisions is unaffected. The invalid provision shall be replaced by an effective provision approximating its commercial purpose.

(4) The German-language version is binding in case of conflicts with translations.

Annexes (separate documents, independently versioned):

• Annex 1: Data Processing Agreement (DPA)
• Annex 2: Confidentiality Module (NDA)
• Annex 3: Privacy Notice
• Annex 4: List of Subprocessors

Operator (Imprint)

P&P Unternehmensgruppe Marco Pavlov Pereira

Deutschland

Email: info@nexusm.de