Confidentiality Agreement (NDA)

Annex 2 to the Usage Agreement · compliant with the German Trade Secrets Act (GeschGehG)

Version 1.1.0 · effective 2026-05-19

§ 1 Parties and Subject Matter

(1) This NDA applies between Buyer and Supplier for all information exchanged via the supplier portal.

(2) It constitutes an "adequate confidentiality measure" within the meaning of § 2 No. 1(b) GeschGehG, a prerequisite for statutory protection of trade secrets.

§ 2 Definition of Confidential Information

(1) Confidential information is all non-public information made accessible by one party (disclosing party) to the other (receiving party) via the platform, in particular:

• technical drawings, 3D models, CAD data,
• mill certificates (EN 10204), EMPB / PPAP, declarations of conformity,
• specifications, requirement specs,
• costing bases, prices, terms,
• supplier and customer lists,
• business strategies, production processes.

(2) Information is not confidential if it is provably:

a) public or generally known at time of disclosure;

b) already known to the receiving party without confidentiality obligation;

c) subsequently disclosed by a third party without confidentiality obligation;

d) independently developed without recourse to confidential information.

§ 3 Confidentiality Measures

(1) The receiving party shall take the following specific protective measures:

a) Access restriction: Confidential information is made accessible only to named personnel on a need-to-know basis, themselves bound to confidentiality (e.g. via employment contract or separate NDA).

b) Encryption at rest: Sensitive content is stored encrypted with at least AES-256 or equivalent.

c) Encryption in transit: Transmissions occur exclusively via TLS 1.2 or higher.

d) Logging: Access to confidential information is logged with timestamp, user ID and action (read / download / print); logs retained for at least 12 months.

e) Physical security: Printouts and mobile media containing confidential information are kept in locked cabinets; removal from premises only in justified exceptional cases with additional safeguards.

f) Sub-commitment: Disclosure to subcontractors only after equivalent written commitment.

g) Training: Personnel handling confidential information receive at least annual training.

(2) The platform's integrated technical safeguards (RLS, encrypted storage, signed URLs, audit log) satisfy items a–d to the extent the information is shared exclusively via the platform.

§ 4 Permitted Use

Confidential information may be used solely for the contractually agreed purpose (initiation, execution and performance of supply and service relationships). Use for other purposes — in particular AI training, own product development outside the contract, or resale — is excluded.

§ 5 Return and Deletion

(1) On the disclosing party's request or at termination of the business relationship, the receiving party returns or documented-deletes all confidential information (auditable deletion log).

(2) Retention is permitted only where mandatory statutory obligations apply (in particular § 257 HGB, § 147 AO, ProdHaftG); in such cases the information continues to be protected with restriction marking.

§ 6 Liquidated Damages

(1) For culpable breach, the receiving party owes liquidated damages in the amount of the actual damage, but at least EUR 10,000 per individual breach. Multiple breaches in the same factual context count as one.

(2) Claims for further damages remain unaffected; liquidated damages are credited.

(3) Claims under the Trade Secrets Act (§§ 6 ff. GeschGehG) remain unaffected.

§ 7 Term

(1) This NDA enters into force with contract conclusion and applies for the term of the business relationship.

(2) The confidentiality obligations continue for five years beyond the end of the business relationship, unless permanent secrecy character requires longer.

§ 8 Final Provisions

(1) German law applies.

(2) The exclusive place of jurisdiction is the disclosing party's seat.

(3) In case of conflict with the Usage Agreement, this NDA prevails for confidential-information protection.

(4) The German version is binding.