Preamble

Introfy GmbH (“Introfy”) specializes in connecting potential employees (“Candidates”) with companies (“Employers”) via the Introfy platform (“Platform”). These General Terms and Conditions (“GTC”) govern the contractual basis for the use of the Platform by Candidates and Employers (“Users”).

1. Use of the Platform

1.1 Candidates may use the Platform via a web application or mobile application, whereas Employers may use it exclusively via a web application.

1.2 Use of the Platform requires the User to register (“Registration”). Registration concludes the contract with Introfy.

1.3 Only natural persons seeking an Employer for themselves personally are eligible to register as Candidates. Registration and use on behalf of a third party or a fictitious person is prohibited. Providing false information during Registration and/or in the Candidate account is likewise prohibited.

1.4 Companies seeking additional employees for themselves are eligible to register as Employers. Only a person authorized to represent the company may register a company. Use on behalf of a third party or a fictitious person is prohibited. Providing false information during Registration and/or in the Employer account is likewise prohibited. 1.5 Introfy may refuse registration on the Platform without stating reasons. Introfy reserves the right to verify the authenticity of registration requests and make completion of the registration subject to such verification. This shall not affect Introfy’s right to verify the authenticity of existing Accounts on a random basis at any time and to delete them in the event of a violation of the aforementioned requirements.

1.6 Users are obliged to keep their login credentials secure and, in particular, not to make them available to third parties.

1.7 Although User Content is stored and made available on the Platform, Introfy’s scope of services does not include cloud storage. Introfy is therefore not obliged to keep User Content permanently available.

1.8 Use of the Platform by minors is prohibited.

1.9 The language of the contract is German. Introfy does not store the text of the contract after entering into the contract with the respective User; however, it is accessible to the User on the website.

1.10 Communication between Introfy, Candidates and Employers may take place via electronic channels.

2. Contact Between Candidates and Employers

2.1 An Employer may create a job posting for a vacant position, in which the Employer defines the requirements for the vacant position (“Job Posting”).

2.2 For the respective Job Posting, the Employer may search for Candidates on the Platform and send them a request (“Request”). Candidates, in turn, may submit an application to Employers as part of a Job Posting (“Application”). 2.3 Employers undertake not to contact candidates whom they become aware of through the Platform by any means other than those provided through the Platform. Any violation of this obligation shall result in a contractual penalty amounting to three times the placement fee specified for the candidate. This shall be without prejudice to the assertion of any further claims for damages or Introfy’s right to the placement fee (see Section 4.2). In such cases, Introfy also reserves the right to terminate the contractual relationship with the employer without delay and delete the employer account.

2.4 Both candidates and employers may accept requests from the other party (“Acceptance”). Upon acceptance, both parties shall have the opportunity to contact each other via the Platform.

3. Successful Placement

3.1 If Introfy’s services result in a contractual relationship between a candidate and an employer (e.g. permanent employment or freelance work), this shall constitute a “Successful Placement.”

3.2 A Successful Placement shall be presumed to have occurred if a contractual relationship between a candidate and an employer is established within 24 months after the candidate’s acceptance, unless the employer can prove that the contractual relationship was established independently of Introfy’s services.

3.3 The employer is obliged to notify Introfy of a Successful Placement without delay, and no later than within 2 weeks, via the Platform. 3.4 If the employer fails to report the Successful Placement in due time, a contractual penalty amounting to three times the placement fee shall become payable to Introfy. This shall not affect the assertion of any claim for damages exceeding this amount, nor the actual claim to the placement fee (see Section 4.4).

4. Fees

4.1 Use of the services is free of charge for candidates.

4.2 In the event of a Successful Placement, the employer is obliged to pay a fee ("placement fee"). This fee is based on the commission amount shown to the employer on the platform for the respective candidate. Placement fees are invoiced at the beginning of each month for the preceding month. The payment period is 14 days. Payments shall be made by bank transfer to the business account specified on the invoice.

5. Data Protection

5.1 Introfy processes users’ personal data in accordance with applicable data protection regulations.

5.2 As the controller within the meaning of data protection law, Introfy processes personal data only to the extent necessary to fulfill its contractual obligations toward the respective user.

5.3 Users upload User Content at their own responsibility. In this respect, Introfy acts as the user’s processor. Accordingly, the data processing agreement attached hereto as Annex 1 (DPA) shall serve as the basis for processing carried out by Introfy, insofar as the user is required to enter into a data processing agreement.

6. Contract Term and Termination

6.1 The user agreement between Introfy and the User is concluded for an indefinite period.

6.2 The parties may terminate the user agreement ordinarily at any time without stating reasons, subject to a notice period of 1 month.

6.3 Termination shall have no effect on fees arising at a later date as a result of a Successful Placement, the obligation to report a Successful Placement, or the threatened contractual penalty in the event that a Successful Placement is not reported.

6.4 The statutory right to extraordinary termination remains unaffected.

7. Liability

7.1 Introfy shall be liable in accordance with the statutory provisions for damage to life, limb or health resulting from a culpable breach of duty. Furthermore, Introfy shall be liable in accordance with the statutory provisions for other damage resulting from intentional or grossly negligent breaches of contract. To the extent that the scope of application of the Product Liability Act is applicable, Introfy shall be liable without limitation in accordance with its provisions.

7.2 If damage is caused by the ordinary negligent breach of a material contractual obligation, meaning an obligation whose fulfillment is essential for the proper performance of the contract, whose breach jeopardizes the achievement of the contractual purpose and compliance with which Users may regularly rely on, Introfy’s liability shall be limited to foreseeable damage typical for the contract. 7.3 No further claims for liability against Introfy shall exist.

8. Miscellaneous

8.1 Should individual provisions of these GTCs be or become invalid or incomplete, the validity of the remaining provisions shall remain unaffected.

8.2 German substantive law shall apply, excluding German conflict-of-law provisions and the UN Convention on Contracts for the International Sale of Goods. Where a place of jurisdiction may legally be agreed, the place of jurisdiction shall be Hamburg.

Preamble

The processor (Introfy) processes personal data on behalf of the controller (user) within the meaning of Art. 4 no. 8 and Art. 28 of Regulation (EU) 2016/679 – General Data Protection Regulation (“GDPR”). This Data Processing Agreement (“Agreement”) specifies the data protection obligations of the contracting parties arising from the processing of personal data described in the main agreement. This Agreement applies to all activities connected with the main agreement in which employees of the processor or third parties commissioned by the processor may come into contact with personal data provided by the controller.

1. Definitions

1.1 Personal data means any information provided by the controller relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more specific characteristics that express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Art. 4 no. 1 GDPR).

1.2 Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Art. 4 no. 2 GDPR). 1.3 Instructions are all directions issued by the Controller to the Processor requiring the Processor to process personal data. The instructions are initially specified in the Main Agreement and may subsequently be amended, supplemented or replaced by the Controller through individual instructions (“Individual Instructions”).

2. Subject Matter of the Agreement, Responsibility

The Processor processes personal data on behalf of the Controller. The Controller is solely responsible for compliance with the statutory provisions of data protection law, in particular for the lawfulness of transferring the personal data to the Processor and for the lawfulness of processing such data (“Controller” within the meaning of Art. 4 No. 7 GDPR).

3. Term

The term of this Agreement corresponds to the term of the Main Agreement. The right to extraordinary termination remains unaffected.

4. Scope, Nature and Purpose of the Intended Processing of Personal Data

The scope, nature and purpose of the processing of personal data by the Processor on behalf of the Controller are specifically described in the Main Agreement.

5. Type of Data

The processing of personal data concerns the following types/categories of data (list/description of data categories):

• Personal data provided by the User themselves, including in particular professional personal data in various formats (text, image, video).

6. Categories of Data Subjects

The categories of data subjects whose personal data are processed include:

• Users and third parties designated by the user.

7. Rectification, Erasure, Blocking and Disclosure of Data

7.1 The controller may, at any time during and after the termination of this agreement or the main agreement, request the rectification, erasure, blocking and disclosure of personal data by means of a lawful individual instruction.

7.2 The controller shall determine, by contract or individual instruction, the measures for returning the data carriers provided and/or erasing the stored personal data after termination of the agreement.

8. Technical and Organisational Measures

8.1 The processor shall implement technical and organisational measures to adequately protect the personal data against misuse and loss, in accordance with the requirements of Articles 24 and 32 GDPR. This includes, in particular, where appropriate,

• preventing unauthorised persons from gaining access to data processing facilities in which the personal data are processed and used (physical access control),

• preventing data processing systems from being used by unauthorised persons (system access control),

• ensuring that persons authorised to use a data processing system may access only the data covered by their access authorisation and that personal data cannot be read, copied, modified or removed without authorisation during or after processing (data access control),

• to ensure that personal data cannot be read, copied, altered or removed without authorization during electronic transmission, transport or storage on data media, and that it is possible to verify and determine the locations to which personal data are intended to be transmitted by data transmission facilities (transmission control),

• to ensure that it is possible to subsequently verify and determine whether and by whom personal data have been entered into, altered in or removed from data processing systems (input control),

• to ensure that personal data can only be processed in accordance with the instructions of the controller (processing control),

• to ensure that personal data are protected against accidental destruction or loss (availability control),

• to ensure that data collected for different purposes can be processed separately (separation control),

• the pseudonymization and encryption of personal data,

• the ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services related to processing,

• the ability to promptly restore the availability of personal data and access to them in the event of a physical or technical incident,

• a procedure for regularly reviewing, assessing and evaluating the effectiveness of the technical and organizational measures to ensure the security of processing. 8.2 The technical and organizational measures are subject to technical progress and further development. In this respect, the Processor is permitted to implement alternative, adequate measures. The security level of the measures specified must not be reduced. Significant changes that may affect the integrity, confidentiality, or availability of the personal data must be documented.

9. Instructions

9.1 The Controller has the right to issue individual instructions to the Processor at any time regarding the nature, scope, and procedures for processing personal data. Individual instructions must be issued in writing.

9.2 The Processor may process personal data only within the scope of the Principal Agreement, this Agreement, and individual instructions, unless the Processor is required to process the personal data under Union law or the law of the Member States.

9.3 Provisions concerning any compensation for additional expenses incurred by the Processor as a result of individual instructions issued by the Controller remain unaffected.

9.4 The Processor must inform the Controller of exceptions to the obligation to follow instructions arising from applicable law, unless that law itself prohibits such notification on important grounds of public interest.

10. Other Rights and Obligations of the Processor

10.1 The Processor shall appoint a data protection officer, where legally required, who may perform their duties in accordance with Articles 37, 38, and 39 GDPR. Their contact details shall be provided to the Controller upon request for the purpose of direct contact. 10.2 The Processor shall ensure that employees involved in processing personal data are bound by data confidentiality obligations (Art. 29 GDPR) and have been instructed in the GDPR’s data protection provisions. The obligation of data confidentiality shall continue to apply after the end of their employment or activities.

10.3 The Processor shall inform the Controller of serious disruptions to operations, suspected data protection breaches, or other irregularities in the processing of personal data. This also applies to any inspection activities and measures taken by the supervisory authority pursuant to Arts. 51–59 GDPR or investigations pursuant to Arts. 83 and 84 GDPR.

10.4 It is acknowledged that, pursuant to Art. 33 GDPR, the Processor may be subject to notification obligations in the event of the unlawful transmission of or gaining knowledge of certain personal data. Such incidents must therefore be reported to the Controller without delay, irrespective of their cause. The Processor’s notification to the Controller must include, in particular, the following information:

• A description of the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects concerned, and the categories and approximate number of personal data records concerned;

• A description of the measures taken or proposed by the Processor to remedy the personal data breach and, where applicable, measures to mitigate its possible adverse effects. The Processor shall take appropriate measures to secure the data and mitigate any potential adverse consequences for data subjects.

10.5 The Processor is obliged to provide the Controller with information at any time insofar as its data and documents are affected by a personal data breach. The Processor shall undertake the data-compliant destruction of materials on the basis of an individual commission from the Controller and at the Controller’s expense. In special cases specified by the Controller in writing, the materials shall be retained or handed over.

10.6 The Controller permits the processing of data in private homes (teleworking or remote work by the Processor’s employees). Where data is processed in a private home, the Processor assures that the measures pursuant to Art. 32 GDPR are also ensured for teleworking and remote work.

10.7 Insofar as the Processor provides services under this Agreement that are not remunerated under the Main Agreement, the Processor may demand reasonable remuneration.

11. Rights and Obligations of the Controller

11.1 The Controller is solely responsible for assessing the lawfulness of the processing of personal data and for safeguarding the rights of data subjects.

11.2 The Controller must inform the Processor immediately and fully in writing if, when reviewing the results of the commissioned processing, the Controller identifies errors or irregularities with regard to data protection regulations. 11.3 The controller is responsible for the information obligations arising from Art. 33 GDPR.

12. Requests from Data Subjects

12.1 If, under applicable data protection laws, the controller is obliged to provide an individual with information about the processing of their personal data, the processor shall, where necessary, assist the controller in providing this information, provided that the controller has requested the processor to do so in writing.

12.2 The processor shall inform the controller if data subjects assert their data subject rights against the processor.

13. Cooperation with the Supervisory Authority

The controller and the processor, and their representatives where applicable, shall cooperate with the supervisory authority upon request in the performance of their duties.

14. Controller’s Audit Obligations

The controller shall satisfy itself of the processor’s technical and organizational measures before commencing data processing and thereafter at regular intervals, and shall document the results. For this purpose, it may, for example, obtain self-assessments from the processor or commission an audit at its own expense. In the event of an audit, the controller shall also bear the costs of the processor’s employees who are required to participate in the audit.

15. Subprocessors

15.1 Subprocessors may be engaged within the scope of this Agreement and the activities specified in Sections 3, 4, 5 and 6, provided that the processor ensures that the subprocessor assumes the obligations under this Agreement vis-à-vis the processor. In particular, the confidentiality, data protection and data security requirements set out in this Agreement shall apply. 15.2 The Client shall be granted rights of inspection and review in accordance with Section 14. Upon written request, the Client shall be entitled to obtain information from the Processor regarding the essential content of the agreement and the implementation of the Subprocessor’s data-protection obligations, where necessary also by inspecting the relevant contractual documents.

15.3 The Processor shall be entitled to engage Subprocessors provided that they comply with the requirements pursuant to Sections 15.1 and 15.2 and that the Processor informs the Client thereof, unless the Client objects in writing within seven days.

15.4 In the event that personal data is processed by Subprocessors in a third country, the Processor shall ensure that such processing is carried out on the basis of an adequacy decision by the European Commission or subject to appropriate safeguards pursuant to Articles 46 et seq., and provided that enforceable rights and effective legal remedies are available to the data subjects.

16. Confidentiality Obligation

The Processor is obliged to maintain confidentiality when processing personal data. The Processor undertakes to observe the same confidentiality and secrecy requirements as those incumbent upon the Client. The Client is obliged to inform the Processor in writing of any special confidentiality and secrecy requirements.

17. General Provisions, Information Obligations, Written-Form Clause, Choice of Law

17.1 If personal data held by the processor is endangered by attachment or seizure, insolvency or composition proceedings, or by other events or measures taken by third parties, the processor must inform the controller of this without undue delay. The processor shall immediately inform all parties responsible in this connection that sovereignty over and ownership of the personal data lie exclusively with the controller as the “controller” within the meaning of the GDPR.

17.2 The processing of personal data shall take place exclusively within the territory of the Federal Republic of Germany, in a Member State of the European Union, or in another contracting state of the Agreement on the European Economic Area. Any transfer to a third country requires the controller’s prior consent and may only take place if the special requirements of Articles 44, 45 and 46 GDPR are met. If the processing is carried out by a subcontractor, the controller hereby grants its consent.

17.3 Amendments and additions to this agreement and all of its components—including any representations or assurances made by the processor—require a written agreement and an express indication that the document constitutes an amendment or addition to this agreement. This also applies to any waiver of this formal requirement.

17.4 German law shall apply, excluding conflict-of-law rules. 17.5 The place of jurisdiction is the place of jurisdiction specified in the main contract.