Terms for the RecoveryCodes service
The agreement and who may use the service
These terms and conditions govern every contract under which Søren Johanson (the “Provider”) supplies the RecoveryCodes software-as-a-service offering to a business customer (the “Client”). The contract covers paid, time-limited access over the Internet to software hosted on the Provider’s servers (the “Software”), together with server storage made available for use with that Software. The service description published on the Provider’s website forms part of that contractual scope.
A Client must be an entrepreneur: a natural person, legal entity, or partnership with legal capacity acting in the course of its commercial or independent professional activity when entering into the contract. These terms are not an offer directed to consumers.
Any terms supplied by the Client are excluded unless the parties expressly agree otherwise.
Links or technical connections in the Software may lead to services supplied by third parties. Whether those services are free or paid, and even where a RecoveryCodes registration is needed to reach them, they are not governed by this agreement. The relevant third party’s terms or the applicable statutory rules govern the relationship with that third party; the Provider supplies technical access only.
Ordering and formation of the contract
Descriptions of the service on the Provider’s website are invitations to order and are not themselves binding offers. The Client places a binding order by completing the online checkout and activating the button that submits it.
Checkout and payment are handled by Paddle.com Market Ltd as merchant of record. Paddle makes the payment methods available and processes the payment in its own name under the terms shown in its checkout.
The contract is formed when the Provider accepts the Client’s order. Acceptance takes place automatically at the end of the checkout once payment has been authorized; the Provider does not carry out a separate manual review and there is no acceptance period during which the Client remains bound. If payment cannot be authorized, no contract is formed.
The order confirmation and the contract information are supplied in text form, for example by email. Where the Client has an account, the order data also remains available there.
Before submitting the order, the Client can review the on-screen information, inspect it using the browser’s zoom function, and correct entries with ordinary keyboard and mouse controls. Corrections remain possible until the order button is activated.
Contracts are concluded in English. Order handling and communications normally take place by email and automated processing. The Client must provide a working, accurate email address and configure any spam filter so that messages from the Provider and service providers engaged for order processing can be delivered.
Software and storage
For the agreed contract period, the Provider enables Internet access to the Software while the Software remains hosted on the Provider’s server. The website’s service description defines the included functions and technical specifications; the Provider owes only those stated functions. Establishing and maintaining the data connection between the Client’s systems and the Provider’s server remains the Client’s responsibility.
The Provider updates the Software at irregular intervals. Access is always to the then-current version, and the Client is not entitled to require any particular historic or future state of the Software.
The Provider also allocates limited server storage for use with the Software. The amount is specified in the website’s service description.
The Provider uses state-of-the-art data-security measures but does not assume a safekeeping or custody obligation. The Client remains responsible for adequate data security and backups.
Except where the website’s service description promises more, the Provider does not owe support beyond the maintenance duties included in the contract. Any documentation made available on the website is provided for convenience and does not create additional obligations.
Development and alteration of the service
The Provider may modify the offered services or substitute different services, provided the result is not unreasonable for the Client.
A modification or substitution may also be made where:
- a change in law requires it;
- it is needed to comply with a court judgment or official decision directed at the Provider;
- it closes an existing security vulnerability;
- it benefits the Client exclusively; or
- it is technical or procedural only and does not materially affect the Client.
A change with no more than an immaterial effect is not a service change for this clause. Purely graphical revisions and rearrangements of functions are examples.
Use rights and Client material
The Provider holds the rights needed to supply the Software. Unless the website’s service description says otherwise, the Client receives, for the contract term, a non-exclusive and non-transferable right to use it for its internal business purposes within this agreement. No broader use is permitted.
To the extent processing Client-supplied content or information is necessary to perform the contract, the Client grants the Provider the required non-exclusive rights without charge for the contract term. Those rights include permanent provision and storage, reproduction, and processing. The Client warrants that it has authority to grant them.
Client systems, accounts and data
The Client must ensure that its hardware and software, including workstations, routers, and data-communication equipment, satisfy the minimum technical requirements of the current Software version.
Access credentials must be stored and protected from third-party access using state-of-the-art measures. The Client must keep use within the agreed scope and notify the Provider immediately of unauthorized third-party access.
The Client may not place data in the allocated storage where its use breaches applicable law, an official requirement or order, a third party’s rights, or an agreement with a third party.
The Client must determine whether its handling of personal data in stored content complies with data-protection law. It must also make suitable backups regularly and scan data and information for viruses or other harmful components before uploading, using state-of-the-art safeguards such as antivirus software.
Programs, scripts, and comparable items installed by the Client must not endanger the Provider’s server or communications network, or the security or integrity of other data held on the Provider’s servers.
If such an item creates a danger or impairment, the Provider may deactivate or uninstall it and, where needed to remove the risk, disconnect the affected server content from the Internet. The Provider will notify the Client of the measure without delay.
Reports, review and restriction of content
The Provider has no general duty to monitor Client content proactively for compliance with law, third-party rights, or these terms. It may nevertheless examine particular content on its own initiative and act when a violation is established.
A Client or affected third party may report suspected illegal content through the contact details in the Provider’s legal notice, including by email. The report may be shared with the Client responsible for the content, but the reporting person’s identity will be disclosed only where absolutely necessary.
Reports and own-initiative reviews always include human content control. Automated technical checks may additionally be used in individual cases.
Once content is found to be illegal, the Provider may, without first contacting or warning the Client, select one or more of these responses in its reasonable discretion:
- warn the Client who published it;
- block it temporarily or delete it permanently;
- suspend contractual performance temporarily or permanently; or
- terminate the contract ordinarily or extraordinarily for good cause.
The response will be proportionate and will balance the affected Client’s interests against the Provider’s interest in conducting its business honestly, smoothly, and without interference. Relevant considerations include:
- the content’s statement and meaning, and its capacity to cause injury or harm;
- how often the Client publishes impermissible content;
- the scale of impermissible publication compared with the Client’s other service use;
- the Client’s apparent intention; and
- where discernible, whether and to what degree the Client was at fault.
After first issuing a warning, the Provider may pause for a reasonable period the handling of reports or complaints from a Client who frequently submits reports or complaints that are manifestly unfounded.
Charges, duration and ending the service
The service is offered exclusively to business customers. Prices shown are net prices and exclude statutory value added tax, which is stated separately and added at the applicable rate. Available payment methods and their terms are shown on the Provider’s website.
The contract runs for an indefinite period. Either party may terminate it effective at the end of any month.
Each party retains the right to terminate extraordinarily for good cause. Good cause exists where, after considering the circumstances and balancing both parties’ interests, the terminating party cannot reasonably be expected to continue until the agreed end date or expiry of a notice period.
Notice of termination may be given in writing, in text form such as email, or electronically through the termination function made available on the Provider’s website.
When the contract ends, access to the Client’s account ends as well, and the Provider is no longer obliged to retain data uploaded by the Client. Where the Client is changing providers or moving to its own on-premises ICT infrastructure, Part B applies.
Defects and opportunity to cure
The Client must notify the Provider immediately of defects, malfunctions, or damage. Statutory liability for defects is excluded where suitability for use is reduced only insignificantly.
Strict liability under section 536a(1) of the German Civil Code (BGB) is excluded for a defect already present when the contract was concluded.
The Client may terminate for failure to provide contractual use only after giving the Provider a sufficient opportunity to remedy the defect and that attempt has failed. A remedy has failed if it is impossible, refused, or unreasonably delayed; if justified doubts exist about its prospect of success; or if requiring it would otherwise be unreasonable for the Client.
Provider liability
The following allocation applies to every contractual, quasi-contractual, statutory, and tort claim for damages or reimbursement of expenses.
Liability is unlimited, regardless of its legal basis, for:
- wilful conduct or gross negligence;
- wilful or negligent injury to life, limb, or health;
- a guarantee, except to the extent the guarantee provides otherwise; and
- mandatory liability, including liability under the German Product Liability Act (Produkthaftungsgesetz).
For negligent breach of a material contractual obligation, liability is limited to damage that is foreseeable and typical for this contract, unless clause 10.2 requires unlimited liability. A material contractual obligation is one imposed to achieve the contract’s purpose, whose performance is essential to proper execution and on which the Client may ordinarily rely.
All liability beyond these rules is excluded. The same limitations govern the Provider’s liability for its legal representatives and vicarious agents.
Third-party claims and confidentiality
The Client will indemnify the Provider against claims by other customers or third parties arising from an infringement of their rights through content posted by the Client or through the Client’s other use of the service. The indemnity includes necessary defence costs and statutory court and lawyers’ fees. It does not apply where the Client is not responsible for the infringement. If a claim is made, the Client must promptly provide complete and truthful information needed to assess and defend it.
The Provider will keep confidential all confidential information learned in connection with the contract or its performance and will not disclose it to third parties. Information is confidential if marked as such or if the circumstances show its confidential nature, regardless of whether it is communicated orally, physically, electronically, or in writing. This duty does not prevent disclosure required by law or by a valid or final authority or court decision.
Future changes to these terms
The Provider may revise these terms without stating a reason unless doing so would be unreasonable for the Client. The Provider will give timely written notice. Unless the Client objects within four weeks after notice, the revised terms are treated as accepted. The notice will explain both the right to object and the consequence of allowing the objection period to expire.
The Provider may also revise the terms where:
- a change in law requires the revision;
- it is needed to comply with a court judgment or official decision directed at the Provider;
- entirely new services or service elements are introduced and require description here, without adversely affecting the existing usage relationship;
- the revision benefits the Client exclusively; or
- the revision is technical or procedural and has no material effect on the Client.
The Client’s termination rights are unaffected by any change mechanism in this section.
Governing law
The law of the Federal Republic of Germany governs all legal relationships between the parties. If a person is nevertheless legally treated as a consumer, this choice does not deprive that person of protection under mandatory provisions of the law of the country of habitual residence.
Annex: moving data and services to another environment
Scope and defined concepts
This annex applies when the Client intends to move from the Provider to another provider or to ICT infrastructure on the Client’s own premises.
A “Data Processing Service” is a digital service supplied to the Client that gives comprehensive, on-demand network access to a shared pool of configurable, scalable, and elastic computing resources, whether centralized, distributed, or highly distributed, which can be rapidly provisioned and released with minimal management effort or Provider interaction.
“Digital Assets” are digital elements, including applications, that the Client has a right to use independently of the contractual relationship for the Data Processing Service being changed.
“ICT Infrastructure on the Client’s Premises” means ICT infrastructure and computing resources owned, rented, or leased by the Client, located in its data centre, and operated either by the Client or a third party.
“Switching” is the process involving the Provider, the Client, and where relevant a receiving Data Processing Service provider, by which the Client moves from the Provider’s Data Processing Service to another service of the same type, another Data Processing Service, or ICT Infrastructure on the Client’s Premises. The process includes extraction, conversion, and uploading of data.
“Exportable Data” is input and output data, including metadata, generated directly, indirectly, or jointly through the Client’s use of the Data Processing Service. It excludes Provider or third-party assets or data protected by intellectual-property rights or constituting a trade secret.
Information available before a switch
The Provider’s website contains its online register of data structures and formats, relevant standards, and open data-interoperability specifications.
Before a Data Processing Service is ordered, the Provider will clearly disclose:
- standard charges and any early-termination penalties;
- any switching charges;
- services whose switch is highly complex or costly, or cannot be made without significant interference with data, Digital Assets, or service architecture;
- any particular services exempt from migration and termination obligations;
- a complete list of transferable data and Digital Asset categories, including at least all Exportable Data;
- a complete list of data categories specific to the Provider’s internal service operation that are excluded from export where disclosure would risk violating the Provider’s trade secrets; and
- known risks to continuity of the Provider’s functions or services.
The switching and exit plan
The parties will agree a switching and exit plan (the “Plan”). In particular, it will set out:
- the assistance to be provided, porting methods and formats, and steps needed to perform the switch;
- each party’s designated contacts;
- estimated time to export and move data and Digital Assets from the Provider’s environment;
- restrictions and technical limitations, including those caused by data storage outside the EU;
- the Provider’s proposed sequence of operations; and
- the Provider’s proposed testing method, if testing is planned.
At the Client’s request, the Provider will explain the relevant procedures to personnel named by the Client and to other third parties the Client authorizes.
At the Client’s request, the Provider will either arrange a test or assist with the Client’s test of whether the Plan works in practice for Exportable Data and Digital Assets. The parties will investigate any test problem in good faith and work toward a solution.
The parties will update the Plan when necessary and, at minimum, assess the need for changes whenever the Client asks.
Notice that starts the switching process
To start Switching, the Client must give the Provider two months’ notice. A partial switch must identify the services, data, or Digital Assets to be transferred.
The notice must state which of these outcomes the Client intends:
- a move to another Data Processing Service provider, together with the necessary target-provider information;
- a move to the Client’s local ICT infrastructure; or
- deletion of Exportable Data and Digital Assets without a move.
No later than three business days after receipt, the Provider will acknowledge the notice through the same communication channel used by the Client.
Transition periods and extensions
The transition period is 30 calendar days, beginning when the two-month initiation notice period ends.
If technical reasons prevent the Provider from meeting that period, the Provider will:
- notify the Client in writing or text form within 14 working days after receiving the termination notice;
- name an alternative transition period ending no later than seven months after the Client’s termination notice; and
- reasonably explain the technical impossibility.
The Client must acknowledge an extension notice in writing or text form within three business days.
Once, the Client may extend the transition by a period it considers appropriate, up to three months. For a complex migration, the parties may agree a longer extension, capped at 12 months. By the end of the original transition period, the Client must give written or text-form notice of its intention and specify the alternative period. The Provider will acknowledge that notice in the same form within three business days.
Each party’s work during the switch
From the start and throughout Switching, the Provider will reasonably support the Client and its appointed third parties so the move can finish within the agreed transition period. In particular, the Provider will:
- supply expertise, appropriate information and necessary switching documents, and technical support, while investigating identified problems with the Client in good faith and working toward solutions;
- use due care to preserve business continuity and continue the contractually specified functions or services; and
- maintain a high level of security throughout, especially while data is transmitted.
The Client will take every reasonable step needed for an effective switch. Importing and implementing data and Digital Assets into the Client’s or target provider’s systems is the Client’s responsibility.
The Client and its appointees, including the target provider, must respect intellectual-property rights and trade secrets in Provider materials supplied for Switching. Access and any necessary sublicence may be given to a third party or target provider only to the extent needed to conduct the switch through the end of the agreed transition period, including an alternative period, and remains subject to confidentiality obligations and the rights granted by the Provider.
Retrieval, retention and deletion
After the agreed transition period ends, the Client has 30 calendar days to retrieve or delete its data. The parties may agree a longer retrieval period where their respective interests make that necessary.
Once the retrieval period has ended and Switching has succeeded, the Provider will delete all Exportable Data and Digital Assets generated by or directly related to the Client and confirm deletion. The exception is Exportable Data that mandatory EU or EU Member State law requires the Provider to retain; for any such data, the Provider will tell the Client what is retained, why, and for how long.
The Provider charges no additional fee for the switching process.
Confirming the outcome of a switch
The Client may agree success criteria and milestones with the Provider and report progress against them, but must in every case notify the Provider when the switch succeeds. The Provider will then immediately notify the Client that the contract is terminated.
If the Client gives no outcome notice although the Provider reasonably believes the switch succeeded, the Provider may ask for confirmation. If the Client does not confirm success within 30 business days, the switch is treated as unsuccessful and the contract continues on its existing terms.
Where the Client requested deletion without moving to another environment, the Provider will notify the Client that the contract is terminated when the agreed notice period ends.
If Switching cannot be completed successfully, the parties will cooperate in good faith to improve the process, complete data transfer on time, and preserve continuity. On request, the Provider will help identify the causes and advise how identified obstacles might be resolved or avoided. In that event:
- the Client may, at its discretion, engage the target provider on its behalf;
- without limiting other remedies under applicable law, the agreement does not end before successful Switching or a corresponding decision of a competent court or forum selected and agreed by the parties; and
- these rules prevail over inconsistent agreements between the parties about termination.
When the service contract ends
For a switch governed by this annex, the contract terminates only when either of these events has fully occurred:
- the switching process is successfully completed; or
- the notice period expires where the Client chose deletion of Exportable Data and Digital Assets rather than a move.
A clause elsewhere in the contract or these terms dealing with termination under law or on a related event does not cause the agreement, services, or functions to end before the relevant event has clearly occurred. This applies, for example, to:
- a request for payment deferral, suspension of payments, or insolvency of a party;
- a continuing failure to perform a material or other obligation on time where contract or law results, or may result, in termination;
- a change in ownership or control that results, or may result, in termination under contract or law;
- the agreement becoming void through breach or amendment of mandatory law; or
- an identical, similar, or other event that results, or may result, in termination under contract or law.
Other rights and remedies between the parties remain available. For this annex, successful completion requires expiry of the notice period, commencement of the transition period after that expiry, commencement of the retrieval period after transition, and successful data deletion after the retrieval period or another agreed period following successful Switching.
Limited service, ordinary notice and fixed terms
After transition, the Client may wish to keep Exportable Data and Digital Assets available with limited functionality for an additional period instead of deleting all of them at the end of retrieval. The parties may likewise wish to continue the contract without selected services unless the Client orders otherwise. Either arrangement requires:
- expiry of the agreed notice period;
- expiry of the transition period; and
- agreement on an alternative retrieval period and the other limited-service or continuing-contract terms, including permission to delete after that period and/or the charge for it.
If the Provider proposes those alternative terms during this period, the contract cannot end before the Client, acting in its sole discretion, accepts deletion and clearly confirms termination.
For an open-ended contract, both parties retain ordinary termination rights where the reason is neither a provider change nor, for the Client, an intention to delete data.
If a contract expressly made for a fixed duration reaches its expiry date before Switching is complete and the Client has not requested deletion of Exportable Data and Digital Assets, the transition period begins on that expiry date and the Provider supplies reasonable switching assistance. The provisions above on successful and unsuccessful Switching then apply correspondingly.