General Terms and Conditions for Vendors and/or Affiliates

These General Terms and Conditions for Vendors and/or Affiliates are divided into the following parts:

  • Part I - General Terms and Conditions for Vendors - These apply if you wish to offer products as a Vendor through copecart.com;
  • Part II - General Terms and Conditions for Affiliates - These apply if you wish, as an Affiliate, to advertise products of our Vendors;
  • Part III - General Provisions for Vendors and Affiliates - These apply to both Vendors and Affiliates;
  • Part IV - Processing of Personal Data by Vendors;
    • Annex 1 to Part IV - Technical and Organisational Measures;
    • Annex 2 to Part IV - Approved Sub-processors;
    • Annex 3 to Part IV - Persons Authorised to Give Instructions;
    • Annex 4 to Part IV - Data Protection Officer;
  • Part V - Processing of Personal Data by CopeCart.



PART I - General Terms and Conditions for Vendors

1. Registration, Changes to and Termination of Registration, Participation Fee

  • 1.1. Registration as a Vendor is available only to entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB). You must provide truthful information when registering. We are entitled to require appropriate evidence of its accuracy and of your status as an entrepreneur. We are further entitled to reject an application for registration without giving reasons.
  • 1.2. You are obliged to complete our Know Your Customer process within one week of registration. If you fail to do so, or if the process is not successfully completed (e.g. due to missing or implausible information), your account will be deactivated and none of your products will be offered for sale until the process has been successfully completed.
  • 1.3. Should your information change, you must update it without undue delay on our website.
  • 1.4. Either party may terminate a registration at any time without notice. The obligation to perform purchase agreements concluded while this Agreement was in force shall remain unaffected. This Agreement shall continue to apply mutatis mutandis to those surviving obligations until their fulfilment. The right to terminate for good cause remains unaffected.

2. Offering Products and Services; Grant of Rights

  • 2.1. Following registration, you are entitled to have products and services (collectively, "Products") offered by us through copecart.com. We shall be the supplier of your Products and services to purchasers (the "End Customers") and accordingly their contractual counterparty. If an End Customer wishes to enter into an agreement to acquire a Product, an agreement shall first be concluded between the End Customer and us and thereafter a corresponding agreement, as a back-to-back transaction ("Covering Transaction"), between us and you. Consequently, no direct agreement for the acquisition of a Product shall be concluded between you and an End Customer.
  • 2.2. We shall advertise and offer your Products at our discretion. At our discretion, we shall provide technical features enabling you or Affiliates to sell Products also through other websites or by other means (e.g. telephone sales). In such cases, too, we shall always be the End Customer's contractual counterparty, and any such sale must comply with these Terms and Conditions. There is no entitlement to have all Products advertised and offered at all times.
  • 2.3. If, in the exercise of our reasonable discretion, we consider that you are in breach of this Agreement and that it would therefore be unreasonable for us to continue offering your Products, we shall block access to your Products and inform you of the suspension and the reasons for it.
  • 2.4. You warrant that your Products may lawfully be placed on the market and offered within the European Union and comply with all relevant statutory requirements. The same obligation applies to all other countries in which your Products are offered, unless you object to offerings beyond the borders of the EU.
  • 2.5. If you wish to offer a Product through us, you must provide all information requested by us in the relevant input form. This includes, in particular, the following information:
    • 2.5.1. Product name;
    • 2.5.2. Price;
    • 2.5.3. Product description;
    • 2.5.4. Availability and term of the agreement;
    • 2.5.5. Shipping costs, if applicable;
    • 2.5.6. Legally required notices to be observed when advertising the Product;
    • 2.5.7. Text and images for freely advertising the Product;
    • 2.5.8. Legally correct classification of the Product in relation to consumers' right of withdrawal, particularly whether it is a digital product or a service.
  • 2.6. You must update any information or data supplied to us without undue delay whenever it changes; such information must comply with statutory requirements at all times. You shall notify us without undue delay if any of your Products does not comply with statutory requirements or this Agreement, or if any third party alleges such non-compliance or an infringement of its rights.
  • 2.7. You shall be liable for information or data supplied incorrectly or incompletely. Accordingly, please verify after listing your Product that all required information has been included and is correct. Your information must enable us to offer and advertise each of your Products in compliance with the law.
  • 2.8. You are not entitled to advertise, or permit advertising, which suggests that CopeCart recommends or otherwise promotes your Products.
  • 2.9. Where we depend on your cooperation to process customer enquiries, complaints, notices of defects or other exercises of rights by customers, you must provide such cooperation without undue delay and free of charge.
  • 2.10. You grant us, free of charge, worldwide rights to use the information, data and any other content supplied to us when listing a Product for the purposes of performing this Agreement and, in particular, advertising and distributing the Products in online and offline media. This grant covers, in particular, all forms of offering and advertising Products on websites, social media services, blogs, by telephone, by video conference, on price-comparison websites and other internet services, as well as in apps. You warrant that you grant us the necessary rights free from any third-party rights that would prevent use in accordance with this Agreement. Upon termination of this Agreement, we shall not be obliged to recall advertisements for Products already published using the rights granted above or to remove such advertisements from public access (e.g. advertisements on social media services).

3. Distribution of Digital Products

  • 3.1. Where your Product can be sent by us in digital form or made accessible by means of a link, you must make the relevant content or access details available to us when listing the Product.
  • 3.2. With respect to such Products, we are entitled, in accordance with the options offered by you, to grant End Customers access to them or provide them to End Customers and permit permanent storage. This includes the rights of reproduction, making available to the public, provision on demand, distribution and communication by all technical and commercial means of exploitation and distribution. Insofar as technically necessary for the performance of the Agreement or appropriate for commercial exploitation, we are entitled to modify the Product to the extent required.
  • 3.3. Where a Product constitutes a digital product within the meaning of Section 327(2) BGB, the following provisions apply and, in the event of any conflict, prevail over the remaining provisions of these Terms and Conditions, unless an exception under Section 327(6) BGB applies:
    • 3.3.1. An End Customer who is a consumer ("Consumer End Customer") may demand that the Product be provided without undue delay after conclusion of the Covering Transaction. You must provide the corresponding services immediately. If you fail to comply with this obligation under Section 327c(1) BGB, we may terminate the corresponding agreement if the Consumer End Customer has terminated the agreement with us accordingly. We shall inform you immediately if a Consumer End Customer makes such a request to us. In all other respects, Section 327c BGB applies mutatis mutandis.
    • 3.3.2. You must provide digital Products to us in accordance with Sections 327e to 327g BGB. Offering digital Products that do not satisfy those requirements is prohibited. If you believe that it is not possible to offer your Product lawfully in accordance with the foregoing provisions, you must inform us accordingly and refrain from having us offer the Product.
    • 3.3.3. You must make updates within the meaning of Section 327f BGB available to us in a manner enabling us to discharge our statutory obligations towards Consumer End Customers, in particular under Section 327f BGB.
    • 3.3.4. It is prohibited to have Products offered for which information must be provided to Consumer End Customers and a separate agreement with them is required under Section 327h BGB.
    • 3.3.5. Changes to digital Products are permitted only in accordance with statutory requirements, in particular Section 327r BGB.
    • 3.3.6. Statutory rights of recourse, in particular pursuant to Sections 327u or 445c BGB, remain unaffected. Any further rights granted to us by these Terms and Conditions also remain unaffected.

4. Prohibited Products

The following Product categories must not be offered:

  • 4.1. Sexually offensive Products;
  • 4.2. Alcohol, tobacco and medicinal products;
  • 4.3. Products that discriminate against third parties on grounds of race, sex, religion, nationality, disability, sexual orientation or age;
  • 4.4. Products infringing third-party rights, in particular trademarks, patents or other intellectual property rights;
  • 4.5. Products subject to statutory advertising prohibitions or restrictions;
  • 4.6. Products that may only be sold to End Customers following age verification (e.g. content rated FSK 18);
  • 4.7. Any Products prohibited by law.

5. Covering Transactions for Products and Services Sold

  • 5.1. Where an End Customer purchases a Product offered by you from us, we shall purchase the corresponding Product from you as a Covering Transaction and engage you to perform the corresponding agreement between us and the customer. Where performance consists of sending digital content or a link, we shall perform the agreement between us and the End Customer to that extent.
  • 5.2. Where a Product may be purchased against several instalments of remuneration (e.g. recurring fees for access to digital content), we shall purchase the Product for each relevant period corresponding to the instalments rather than immediately for the entire term. Where the End Customer defaults on further instalments, the purchase from you shall occur only when we have received the corresponding amounts.
  • 5.3. In relation to the Product, we shall provide the End Customer only with the information supplied to us by you and incorporate exclusively our then-current General Terms and Conditions, available at copecart.com/agb.
  • 5.4. The Covering Transaction shall be concluded immediately and automatically without any separate declaration on your part. To this extent, both parties waive receipt of the respective declarations of intent concerning conclusion of the agreement. We shall inform you of the conclusion of each Covering Transaction by email containing all relevant data. You may also access the corresponding transactions on our website.
  • 5.5. As a result of the conclusion of the Covering Transaction, you shall be entitled to the gross sale price specified by you and charged to the End Customer, less the fees due to us, namely 4.9% + EUR 1 per transaction. As from 1 January 2027, our standard fee shall be 6.9% + EUR 1 per transaction. The applicable fee shall be deducted before payments are released. Of the resulting amount, 80% shall be released for payment after expiry of the End Customer's 14-day withdrawal period and the remaining balance after a further 40 days, provided that we have received the money from the End Customer. Payments shall be made on the dates selected by you on our website to the account or similar payment destination specified by you. The remuneration due to you shall be understood to include applicable VAT in addition, provided that you have entered your valid VAT identification number in your profile in good time before the invoice is issued. No subsequent entitlement to correction of an invoice shall exist. Where you have consented to the initiation of debt collection measures against an End Customer in payment default, you shall bear the debt collection costs indicated by us in this connection.
    • 5.5.1 Where the Klarna payment method is used, our fee shall, in derogation from the fee referred to in the first sentence of Clause 5.5, be 6.99% + EUR 1 per transaction and shall be deducted before payments are released.
    • 5.5.2 Where the SeQura payment method is used, the following special arrangements apply in derogation from Clause 5.5: Our fee shall be 6.99% + EUR 1 per transaction and shall be deducted before payments are released. We shall release 80% of 88% of the gross sale price for payment after 14 days. The remaining 20% of 88% shall be released after a further 40 days. Three months after the End Customer has paid the last instalment to SeQura, we shall release 80% of the remaining 12% for payment 14 days later. The balance shall in turn be released for payment after a further 40 days.
    • 5.5.3 Where the PayPal payment method is used, the following special arrangements apply in derogation from Clause 5.5: The amount of our fee remains unchanged. After deduction of our fee, 80% of the gross sale price shall be released for payment after an 18-day period and the balance after a further 75 days, provided that we have received the money from the End Customer via PayPal.
    • 5.5.4. Where the credit card payment method is used, our fee shall be 6.9% + EUR 1 per transaction as from 1 November 2026.
    • 5.5.5. For the purposes of the fee changes provided for in Clauses 5.5 and 5.5.4, a distinction shall be made between subscriptions and instalment payment arrangements. Under subscriptions, recurring services relating to successive billing periods are remunerated separately. Where the relevant fee change has been validly agreed with the Vendor, the amended fees shall also apply to existing subscriptions, but only to transactions attributable to billing periods commencing on or after the relevant effective date. Under an instalment payment arrangement, by contrast, a fixed total purchase price agreed when the contract was concluded is merely paid in instalments. For instalment payment arrangements concluded before the relevant effective date, the fees agreed when the underlying contract was concluded shall continue to apply to all related instalments, even if individual instalments become due or are received after that date. The special fees under Clauses 5.5.1 to 5.5.3 remain unaffected. Changes to fees for Vendors already registered are governed by Clause 5.5.6. The cost-based adjustment conclusively defined there may be made under Part III Clause 8; any other fee change requires express agreement.
    • 5.5.6. Cost-based adjustment of fees for Vendors already registered. CopeCart may adjust a fee applicable to a Vendor only to the extent that verifiable, directly transaction-related costs for the affected payment method or contract type have increased or decreased since the current fee was set. Only actual charges incurred by external payment service providers, acquirers and card schemes, and directly attributable costs of technical payment processing and the fraud prevention and security required for it, may be taken into account. General administration, sales, marketing and other overheads, increases in profit or margin, and costs not directly related to the affected transactions shall be excluded. The adjustment may not exceed the net cost change attributable to the affected transactions, calculated on a comprehensible and documented basis; cost reductions must be reflected in the same way. At least six weeks in advance, CopeCart shall notify the Vendor in text form at the email address designated for contractual communications of the existing and adjusted fee, the affected payment methods and contract types, the cost categories, the calculation basis and the effective date, and shall clearly state that the adjustment will be deemed accepted unless the Vendor objects in text form within that period. The deemed-consent mechanism under Part III Clause 8 applies to this narrowly defined cost-based adjustment; a timely objection means the existing fee continues to apply to that Vendor. Any other fee change, in particular one not based exclusively on the cost changes described above, requires a separate express agreement. Despite any adjustment, the fees agreed for instalment payment arrangements already concluded shall continue to apply. For ongoing subscriptions, an adjustment applies only to transactions from billing periods commencing on or after the effective date; Clause 5.5.5 shall otherwise remain unaffected.
    • 5.5.7. Payments to Vendors shall only be made from a threshold of EUR 150 per payment and, irrespective of the amount, upon termination of the agreement in accordance with the due-date provision in Part I Clause 5.5 above.
  • 5.6. At our discretion, we may give you the opportunity, for certain Products and/or types of agreement offered by you, to consent to our selling our claim against the purchaser of the Product to a factoring company. Where we exercise this option with your consent and the factoring company acquires the claim in an individual case, we shall pay the remuneration due to you for the relevant agreement as soon as we receive payment from the factoring company. This accelerated payment shall be subject to the additional fees agreed with you for that purpose. If the factoring company reverses the purchase of a claim for reasons attributable to you (e.g. reversal due to an invalid waiver of the right of withdrawal resulting from your incorrect classification of the Product, or because the Product breaches Part I Clause 4 of the Terms and Conditions), you shall accordingly repay the amounts received early, unless the customer has otherwise discharged our claim.
  • 5.7. Payment of the purchase price is conditional upon your having stated in your profile whether you are subject to VAT and having provided any VAT identification number you possess.
  • 5.8. If you are unable to deliver ordered Products, or to deliver them within the stated delivery time, you must inform us without undue delay. In such case, we are entitled to withdraw from the relevant agreement with you.

6. Use of "CopeCart" or "copecart.com"

We permit you to use the name "copecart" or "copecart.com" only insofar as is necessary to indicate, in the customary manner, that a Product can be purchased through copecart.com. Any further use of our distinctive signs requires our prior consent.

7. CopeMember

  • 7.1. Following registration, a Vendor has access to CopeMember within the scope and limits of the free usage model offered by us as part of CopeCart. The Vendor may use this only to fulfil Covering Transactions within the meaning of Part I Clause 5, i.e. for End Customers of the Vendor's Products sold by CopeCart.
  • 7.2. Any more extensive use of CopeMember or use for other purposes requires a paid CopeMember package.
  • 7.3. The Vendor is responsible for content published in CopeMember, including content published by End Customers, and shall indemnify CopeCart against justified claims by third parties (e.g. for infringements of third-party rights or other unlawful content). Use of CopeMember is subject to the data processing agreement in Part IV.

8. Joint Ventures between Vendors

  • 8.1. Two Vendors may enter into a so-called joint venture for a Product using the features offered by us. The applicant for establishing a joint venture shall be the Vendor offering the Product (the "Applicant"). The Applicant remains our contractual counterparty for the relevant Product pursuant to these Terms and Conditions. However, a reduction in the remuneration due to the Applicant from the sale of the Product shall be agreed in accordance with the application to establish the joint venture. We may reject such an application without giving reasons.
  • 8.2. Upon establishment of the joint venture, the amount by which the Applicant's remuneration claim has been reduced shall be due to the Vendor designated by the Applicant (the "Beneficiary"). The Beneficiary acquires this remuneration claim directly against us. Accordingly, it is CopeCart, and not the Applicant, that makes the payment. Where we have a claim against the Applicant for repayment, in whole or in part, of remuneration paid to the Applicant under the joint venture, we shall have a corresponding claim against the Beneficiary.
  • 8.3. We are not a party to the agreement entered into by the Applicant and the Beneficiary for the purposes of the joint venture.
  • 8.4. A joint venture may be terminated at any time without notice.

9. Activation of Affiliate Campaigns

  • 9.1. Within the scope of the options offered by copecart.com from time to time, you may enable third parties ("Affiliates") to advertise Products offered by you. The configuration of the corresponding Affiliate programme and selection of participating Affiliates are at our discretion. We are the Affiliates' contractual counterparty and may at any time decline to activate, restrict or discontinue advertising measures.
  • 9.2. If you wish to make such advertising options available, you undertake to provide only truthful and non-misleading information enabling the advertising measure to be carried out lawfully. You may not grant Affiliates incentives or promotions for advertising measures outside copecart.com.
  • As part of an advertising campaign, you may provide for remuneration to be paid to the Affiliate. Upon satisfaction of the conditions for payment, we shall initially be the party owing this remuneration to the Affiliate. We shall recharge to you the commissions paid to Affiliates on your behalf and set them off against payment claims due to you from us.

10. Shipping of Physical Products

You must ship physical Products acquired by us from you under a Covering Transaction to the End Customer without undue delay. Shipping shall be at your expense and risk. You should therefore insure the shipment.

11. Instalment Payment Arrangements

If you are personally involved in acquiring customers for Products offered by us and we have permitted you to agree instalment payments for that purpose, the price under an instalment arrangement must not exceed the price for immediate payment. A higher instalment purchase price is permitted only if the instalment period does not exceed three months from conclusion of the agreement between us and the End Customer.

12. Payments, Taxes and Charges

  • 12.1. Before receiving payments due to you, you must complete our identification procedure (Know Your Customer - KYC). This procedure is similar to the identification process routinely carried out by banks to prevent money laundering and ensures that you or your business (whether a natural or legal person) are the legitimate payee. Before we pay amounts due to you, you must also provide evidence of your status as an entrepreneur and of payment of VAT by you or your exemption from VAT (small-business scheme). If further evidence is required due to your business location in order to make payments to you (e.g. for anti-money laundering purposes), you must submit such documents to us in advance.
  • 12.2. If the clearing account maintained for you shows a balance owing to us, you must settle it within 30 days of becoming aware of it (e.g. upon receiving a payment demand from us).
  • 12.3. Where we are obliged to withhold taxes or charges from remuneration payable to you, the amount paid out to you shall be reduced accordingly and we shall remit the corresponding sums to the competent authority. In all other respects, you alone are responsible for the proper taxation of your income.

13. Advertising Measures; Termination Button for Subscription Products

  • 13.1. If you, your vicarious agents or Affiliates are involved in acquiring customers for Products offered through us, you must comply with all statutory requirements. This applies in particular to the German Act against Unfair Competition and statutory consumer protection provisions. If the End Customer does not personally complete the purchase through a website offered by us, you must ensure that the sales process complies with the law and, in particular, that all information duties (especially regarding the existence of consumers' withdrawal rights) are fulfilled. You must also ensure that our General Terms and Conditions for End Customers are effectively incorporated into the agreement. It is further prohibited to make statements during the sales process that differ from the agreement we conclude with the relevant End Customer.
  • 13.2. On websites serving to advertise or directly or indirectly conclude continuing obligations with consumers in relation to Products requiring us to provide services for remuneration, you are obliged to include a termination button in accordance with Section 312g BGB. If a consumer uses this to terminate an agreement with us, you must inform us thereof without undue delay.
  • 13.3. If you culpably breach the requirements of Part I Clause 13, you shall indemnify us against the resulting claims and costs.

14. Reversal of a Covering Transaction

  • 14.1. If an End Customer validly withdraws from an agreement to purchase a Product, we are entitled to reverse the corresponding Covering Transaction with you accordingly.
  • 14.2. The same applies if an End Customer is entitled, for other reasons not attributable to us, to reverse an agreement for the purchase of one of your Products (e.g. due to delay in performance or defects).

15. Data Protection; Use of Customer Data for Advertising; Double Opt-In

  • 15.1. When listing a Product, you must truthfully state, in compliance with statutory requirements, which personal data concerning an End Customer you require from us in order to fulfil the Covering Transaction towards the End Customer. Where we transfer End Customer personal data to you for this purpose, you may process such data only for that purpose or where you are otherwise legally entitled to do so. Where you act as our processor in this respect, the data processing agreement in Part IV shall apply.
  • 15.2. Any processing of End Customer personal data in breach of data protection law is otherwise prohibited and entitles us to terminate the contractual relationship with you with immediate effect. Further claims remain unaffected.
  • 15.3. You may use End Customers' personal data for advertising purposes only where the statutory requirements are met. Any provision of contact details by us does not, without satisfaction of the relevant requirements, authorise you to use those details for advertising, e.g. email newsletters. Where we inform you that one of your customers has consented to receiving an email newsletter from you, we do not verify that opt-in by means of a double opt-in. We therefore recommend that you conduct a double opt-in yourself to establish the proof of consent required by case law. Otherwise you may be unable to prove that a customer validly consented to receiving advertising emails.
  • 15.4. We offer the option of transferring personal data of our End Customers made available to you to other online services (e.g. newsletter tools). You are responsible for establishing a legal basis under data protection law for such transfer and for concluding any necessary agreements between you and the data recipient.

16. Third-Party Services

  • 16.1. At our discretion, we offer options for transmitting data from your account to services provided by third parties or receiving data from such services. We are not the provider of those services and are not responsible for them.
  • 16.2. You must conclude the contracts necessary to use third-party services yourself and must use those services in compliance with your contractual and statutory obligations.

PART II - General Terms and Conditions for Affiliates

1. Definitions

For the purposes of Part II, the following definitions apply:

  • 1.1. "Advertisers" means Vendors who offer Products through copecart.com and provide advertising materials for those Products for publication by Affiliates.
  • 1.2. "Affiliates" means persons wishing to publish advertising materials of Advertisers on advertising spaces operated by them.
  • 1.3. "Technical Safeguards" means measures designed to establish whether a user has clicked on an advertisement on a particular advertising space and to prevent the simulation or misuse of such clicks.
  • 1.4. "Users" means natural persons who visit or otherwise view an advertising space without intending to generate revenue for the Publisher or other third parties.
  • 1.5. "Advertising Materials" means materials made available by Advertisers.
  • 1.6. "Advertising Spaces" means spaces operated by and under the responsibility of an Affiliate for the publication of advertising on websites, in apps or in other digital services offering advertising space.
  • 1.7. "Advertising Campaigns" means temporary advertising measures of Advertisers for which advertisements are provided.

2. Registration, Changes to and Termination of Registration

  • 2.1. Registration as an Affiliate is only available to entrepreneurs within the meaning of Section 14 BGB. You must provide truthful information when registering. We are entitled to require suitable evidence of the accuracy of that information and your entrepreneurial status. We may also reject an application for registration without giving reasons.
  • 2.2. Should your details change, you must update them without undue delay on our website.
  • 2.3. Either party may terminate a registration as an Affiliate by giving one week's notice.

3. Participation in the Affiliate Programme

  • 3.1. Affiliates must incorporate Advertising Materials in a manner compliant with the law and only on Advertising Spaces designed and operated in accordance with applicable legal requirements. You may not make statements about the advertised Products that differ from those made by us. This applies in particular to the description of the Products or the rights to which the purchaser is entitled.
  • 3.2. Advertising Materials must not be published on Advertising Spaces liable to damage our reputation or that of the Advertiser, or where those spaces are in an environment that would constitute a prohibited service if Section 4 of the German Interstate Treaty on the Protection of Minors in the Media (JMStV) were applicable.
  • 3.3. Furthermore, Advertising Materials must not be displayed on Advertising Spaces belonging to the following services:
    • 3.3.1. Services directly or indirectly allowing the downloading or streaming of legally protected content without the consent of its rights holders;
    • 3.3.2. Services involving: forced-click systems, cashback or bonus schemes, Paid4 leads (paid mailers, paid clicks, paid leads), temporary email addresses, incentive clicks for SMS dispatch, banner networks or banner exchange systems, "banner farm" websites, websites consisting solely of advertising banners, ViewBar lead/sale programmes in pop-ups/frames, and competition-entry services.
  • 3.4. Advertising Materials placed contrary to the foregoing requirements give rise to no remuneration claims, entitle us to terminate for good cause and may give rise to damages claims.
  • 3.5. Advertising Materials may only be used in the form in which we supply them. Where provided with Technical Safeguards, they may only be used together with those safeguards as prescribed by us.

4. Participation in Advertising Campaigns; Use of Advertising Materials; Remuneration

  • 4.1. An Affiliate may participate in Advertising Campaigns made available by Advertisers where we provide the corresponding Advertising Materials. There is no entitlement to participate in a particular Advertising Campaign or use particular Advertising Materials.
  • 4.2. We are entitled to terminate individual Advertising Materials or campaigns at any time, including early termination.
  • 4.3. Advertising Materials and Technical Safeguards must be used properly on Advertising Spaces in accordance with our instructions.
  • 4.4. The Affiliate receives no remuneration merely for incorporating Advertising Materials into an Advertising Space. Remuneration is due only where a User interacts with the Advertising Materials and subsequently places an individual order on copecart.com.
  • 4.5. The amount of remuneration is determined by the information we provide when promoting opportunities to participate in an Advertising Campaign. Unless otherwise stated, the remuneration claim arises only once we have received full payment from the End Customer under the agreement brokered by the Affiliate and have not had to refund the purchase price. No claim arises where the Affiliate and Vendor are identical and the Affiliate thus purchases its own Product or where the Affiliate purchases a Product through its own Affiliate link.
  • 4.6. Our accounting systems form the basis for calculating the remuneration due to the Affiliate. The Affiliate may furnish evidence to the contrary.
  • 4.7. Eighty per cent (80%) of the Affiliate remuneration shall be released for payment after expiry of the End Customer's 14-day withdrawal period for the brokered agreement and the balance after a further 40 days. Payment shall be made according to the details entered by the Affiliate on our website. Objections to our settlement statement must reach us no later than 14 days after its date. Thereafter, the payment amount shall be deemed approved.
  • 4.8. Payments shall only be made from a threshold of EUR 150 per remuneration distribution and, irrespective of the amount, upon termination of the agreement in accordance with the due-date provision in Part II Clause 4.7 above.
  • 4.9. Remuneration generated in breach of this Agreement, or for which it subsequently transpires that the conditions for entitlement were not met, shall be recoverable.

5. Rights in Advertising Materials

  • 5.1. Advertising Materials made available to the Affiliate under this Agreement and any related Technical Safeguards may only be used in the form provided and solely for the purposes of this Agreement. Any other use or disclosure to third parties is prohibited.
  • 5.2. Advertising Materials and Technical Safeguards may not be modified or adapted.
  • 5.3. For the duration of the Agreement or the respective Advertising Campaign (whichever is shorter), we grant the Affiliate only those rights in the Advertising Materials and Technical Safeguards necessary for their contractual use, deployment and publication.
  • 5.4. The Affiliate is not entitled to provide third parties with Advertising Materials or Technical Safeguards or grant rights in them to third parties.

PART III - General Provisions for Vendors and Affiliates

1. Warranties, Liability and Indemnification by Vendors and Affiliates

  • 1.1. Vendors shall indemnify us, as between the parties, against third-party claims relating to Products sold by us under this Agreement. This includes, in particular, warranty, liability and product liability claims. This shall not apply where the Vendor is not responsible for the circumstances giving rise to the claims. The indemnity shall include in particular expenditure on remedying defects, removal and installation costs, damages claims, liability claims, demands and costs of examining and, where applicable, defending such claims (including reasonable legal advice costs at an hourly rate of up to EUR 350 net and litigation and court costs).
  • 1.2. Where Vendors or Affiliates culpably breach obligations under their contractual relationship with us and we are therefore pursued by third parties, the relevant Vendor or Affiliate shall indemnify us against those claims by corresponding application of Part III Clause 1.1.
  • 1.3. We shall inform affected Vendors or Affiliates of the assertion of claims within the meaning of Part III Clauses 1.1 and 1.2 and involve them appropriately in examining and, where applicable, defending those claims.

2. Communications

You must provide an email address at which we can reach you at all times and at which incoming emails will be read and responded to personally, rather than automatically, within one working day. If you register to advertise a Vendor's Product, that Vendor (whose partner programme you have joined) may send you emails containing relevant information about its partner programme and supporting your advertising of its Products. You may object to receiving such emails directly to the respective Vendor at any time.

3. Liability

  • 3.1. You undertake to assume the statutory warranty obligations arising under the agreement between you and us. You must indemnify us against product liability claims. Warranty and liability claims by purchasers arising from your Products sold through us may also be settled between you and the purchasers. This does not release us from our obligations.
  • 3.2. Warranty, liability and indemnification claims include in particular expenditure on remedying defects, removal and installation costs, damages claims, liability claims, demands and costs (including reasonable costs of legal advice at an hourly rate of up to EUR 350 net, defence costs and litigation and court costs).

4. Suspension of Accounts

We are entitled to suspend Vendors' and Affiliates' accounts and their offerings if we consider that they are in breach of the law or this Agreement to such an extent that further activity through their accounts would be unreasonable for us. We shall inform those affected without undue delay, specifying the reasons.

5. Our Liability

  • 5.1. Liability for intentional conduct and gross negligence is unlimited.
  • 5.2. In the event of a breach of material contractual obligations caused by ordinary negligence, liability shall be limited in amount to foreseeable losses typical of the contract. Material contractual obligations are those whose fulfilment makes proper performance of the Agreement possible in the first place and on whose observance the affected party may ordinarily rely. The limitation period for claims under this paragraph is one year.
  • 5.3. Part III Clause 5.2 does not apply to claims for injury to life, body or health, fraudulent conduct, assumption of a guarantee, liability for initial inability to perform or impossibility for which we are responsible, or claims under the German Product Liability Act.
  • 5.4. In all other respects, liability is excluded irrespective of the legal basis.

6. Our Warranties

  • 6.1. Subject to statutory limits, we shall be entitled to choose the manner of subsequent performance.
  • 6.2. The limitation period for warranty claims is one year. This does not apply to liability claims, for which the liability provisions shall apply.

7. Governing Law and Jurisdiction

  • 7.1. This Agreement is governed exclusively by the laws of the Federal Republic of Germany. Rules of private international law shall not apply to the extent that they may lawfully be excluded.
  • 7.2. The courts at our registered office shall have exclusive jurisdiction over all disputes arising in connection with this Agreement. We may also sue our contractual counterparty at any of its statutory places of jurisdiction.

8. Amendments to these General Terms and Conditions

  • 8.1. We may propose amendments to Parts I to III of these General Terms and Conditions where there is an objective reason for doing so, in particular to reflect changes in legal or regulatory requirements, demonstrable security or fraud-prevention risks, technical or organisational procedures, or to clarify or correct provisions. Amendments under this Clause must neither materially alter the contractual balance between performance and consideration nor restrict any material rights or obligations of the Vendor or Affiliate or otherwise unreasonably disadvantage them.
  • 8.2. We shall notify the Vendor or Affiliate of any such proposed amendment in text form at the email address designated for contractual communications at least six weeks before its intended effective date. The notification shall set out the proposed amendments in a comprehensible manner, the objective reason for them and their intended effective date.
  • 8.3. Provided that the requirements of this Clause 8 are met, the Vendor or Affiliate shall be deemed to have consented to the proposed amendments if they do not object in text form before the intended effective date. In the amendment notice, we shall specifically and clearly draw attention to the objection deadline and to the fact that silence will be treated as consent. An objection may, in particular, be made by replying to the amendment notice. The objection period for the cost-based fee adjustment under Part I Clause 5.5.6 shall be at least six weeks.
  • 8.4. The deemed-consent mechanism shall not apply to changes in fees or other material payment or payout terms. The sole exception is the cost-based fee adjustment under Part I Clause 5.5.6, and only within the conditions and limits set out there. The mechanism shall also not apply to material changes in the scope of services, liability, warranties or indemnification obligations, or any other changes materially affecting the contractual balance. Those changes require a separate express agreement; mere silence in response to a proposed amendment shall not suffice.
  • 8.5. If an objection is made in time, the existing contractual terms shall continue to apply. Statutory and contractual termination rights remain unaffected. Covering Transactions validly concluded and other claims arising before the amendment date shall not be amended retroactively under this Clause.
  • 8.6. This Clause 8 does not apply to amendments to the personal data processing agreements in Parts IV and V, including their annexes. Any procedures for amendments, approvals and objections laid down therein, as well as statutory data protection requirements, shall continue to apply.

9. Severability

Should any provision of these General Terms and Conditions be or become wholly or partially invalid, the remaining provisions shall remain unaffected unless the removal of individual clauses would place one party at such an unreasonable disadvantage that it could no longer reasonably be expected to remain bound by the Agreement.

PART IV - Processing of Personal Data by Vendors

1. Introduction, Scope and Definitions

  • 1.1. CopeCart (the "Controller" for the purposes of this Part IV) has the Vendor (the "Processor" for the purposes of this Part IV) process personal data on its behalf for the performance of Covering Transactions (each a "Main Agreement"). For the performance of the Main Agreement, the Controller engages the Processor to process personal data under Article 28 GDPR insofar as the statutory requirements are met. This Data Processing Agreement prevails over the Main Agreement in the event of any conflict.
  • 1.2. Terms used in this Agreement shall have the meanings assigned to them in the EU General Data Protection Regulation. Accordingly, the party commissioning the processing is the "controller" and the party performing it is the "processor". Where declarations are required below to be made "in writing", this refers to the written form under Section 126 BGB. Otherwise, declarations may also be made in other forms, provided that adequate evidence can be maintained.

2. Nature and Purpose of Collection, Processing or Use of Data

Nature and purpose of processing: The processing comprises collection, recording, organisation, structuring, storage, adaptation or alteration, cross-selling, upselling, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data. The purpose of processing is performance and administration of agreements. Categories of data subjects: Customers.

3. Subject Matter and Duration of Processing

  • 3.1. Subject matter:
  • The Processor undertakes the following processing operations:
  • General personal data:
    • name;
    • date and place of birth;
    • or place of residence of a person;
  • identification numbers;
  • online data.

Processing is based on the Main Agreements existing between the parties.

  • 3.2. Duration: Processing begins on the date of conclusion of the respective Main Agreement and continues for an indefinite period until this Agreement or the Main Agreement is terminated by either party.

4. Obligations of the Processor

  • 4.1. The Processor shall process personal data solely as contractually agreed or as instructed by the Controller, unless the Processor is legally required to carry out specific processing. Where such obligations apply, the Processor shall notify the Controller before processing unless prohibited by law. The Processor shall not use data provided for processing for any other purpose, particularly its own purposes.
  • 4.2. The Processor confirms that it is familiar with the relevant general statutory provisions on data protection. It shall observe the principles of proper data processing.
  • 4.3. The Processor undertakes to maintain strict confidentiality in relation to processing.
  • 4.4. Persons who may gain access to data processed on behalf of the Controller must undertake in writing to maintain confidentiality unless already subject to an applicable statutory duty of secrecy.
  • 4.5. The Processor warrants that persons engaged by it in processing have been familiarised with the relevant data protection provisions and this Agreement before processing begins. Appropriate training and awareness measures shall be repeated regularly. The Processor shall ensure that persons engaged in processing are appropriately instructed and supervised on an ongoing basis as regards compliance with data protection requirements.
  • 4.6. In connection with the commissioned processing, the Processor shall assist the Controller in preparing and updating the record of processing activities and in carrying out data protection impact assessments. All necessary information and documentation shall be maintained and forwarded to the Controller without undue delay upon request.
  • 4.7. Where the Controller is subject to an inspection by supervisory authorities or other bodies, or data subjects exercise their rights against the Controller, the Processor shall provide necessary assistance insofar as commissioned processing is concerned.
  • 4.8. The Processor may provide information to third parties or data subjects only with the Controller's prior consent. It shall forward enquiries addressed directly to it to the Controller without undue delay.
  • 4.9. To the extent legally required, the Processor shall appoint a knowledgeable and reliable data protection officer. It shall ensure that the officer has no conflicts of interest. In cases of doubt, the Controller may contact the data protection officer directly. The Processor shall inform the Controller without undue delay of the data protection officer's contact details or explain why none has been appointed. Changes to the officer or the officer's internal duties must be communicated to the Controller without undue delay.
  • 4.10. Processing shall in principle take place within the EU or EEA. Any transfer of processing to a third country shall require the Controller's express consent and compliance with Chapter V GDPR and the provisions of this Agreement.
  • 4.11. Where the Processor is not established in the European Union, it shall appoint a responsible contact person within the European Union in accordance with Article 27 GDPR. The contact person's details and any changes to that person shall be communicated to the Controller without undue delay.

5. Notification Obligations

  • 5.1. The Processor shall notify the Controller without undue delay of any personal data breach. Reasonable suspected breaches must also be notified. Notification must be sent to an address designated by the Controller within no more than 24 hours after the Processor becomes aware of the relevant event and contain at least:
    • 5.1.1. a description of the nature of the personal data breach, where possible including the categories and approximate number of data subjects and the categories and approximate number of personal data records affected;
    • 5.1.2. the name and contact details of the data protection officer or other contact point for further information;
    • 5.1.3. a description of the likely consequences of the personal data breach;
    • 5.1.4. a description of the measures taken or proposed by the Processor to remedy the breach and, where applicable, mitigate its possible adverse effects.
  • 5.2. Material disruptions in performing the engagement and breaches of data protection law or of this Agreement by the Processor or its personnel must also be reported without undue delay.
  • 5.3. The Processor shall inform the Controller without undue delay of inspections or measures by supervisory authorities or other third parties insofar as they relate to commissioned processing.
  • 5.4. The Processor warrants that it will assist the Controller as necessary with its obligations under Articles 33 and 34 GDPR.

6. Technical and Organisational Measures

  • 6.1. The data security measures described in Annex 1 are agreed as binding. They define the minimum standard owed by the Processor. The measures must be described in sufficient detail for a knowledgeable third party to determine unambiguously, solely on the basis of the description, the minimum standard required at all times. References to information that cannot be obtained directly from this Agreement or its annexes are not permitted.
  • 6.2. The data security measures may be adapted to technological and organisational developments provided that the agreed level of protection is not reduced. The Processor shall implement without undue delay any changes necessary to maintain information security. Changes must be notified to the Controller without undue delay. Material changes must be agreed between the parties.
  • 6.3. The Processor shall notify the Controller without undue delay if the security measures implemented do not, or no longer, satisfy the Controller's requirements.
  • 6.4. The Processor warrants that data processed on behalf of the Controller are kept strictly separate from other datasets.
  • 6.5. No copies or duplicates shall be made without the Controller's knowledge. This excludes technically necessary temporary reproductions provided that the agreed level of data protection is not impaired.
  • 6.6. Processing data in private homes is permitted only with the Controller's prior written consent in each individual case. Where such processing occurs, the Processor shall ensure that a level of data protection and data security consistent with this Agreement is maintained and that the Controller's audit rights under this Agreement can also be exercised without restriction in the private homes concerned. Processing on behalf of the Controller using private devices is prohibited in all circumstances.
  • 6.7. Dedicated data storage media originating from or used for the Controller shall be specially labelled and subject to ongoing management. They must be stored appropriately at all times and must not be accessible to unauthorised persons. Incoming and outgoing movements shall be documented.
  • 6.8. The Processor shall provide regular evidence of compliance with its obligations, particularly full implementation and effectiveness of the agreed technical and organisational measures. Such evidence shall be provided to the Controller without request at least every 12 months and otherwise whenever requested. Evidence may be provided by approved codes of conduct or approved certification schemes.

7. Sub-processing Arrangements

  • 7.1. Subcontractors may be engaged only with the Controller's written consent in each individual case.
  • 7.2. Consent may only be given where the subcontractor has been contractually bound by data protection obligations at least comparable to those agreed in this Agreement. Upon request, the Controller shall be granted access to relevant agreements between the Processor and subcontractors.
  • 7.3. The Controller's rights must also be enforceable against the subcontractor. In particular, the Controller must be entitled to carry out audits of subcontractors at any time to the extent specified herein, either itself or through third parties.
  • 7.4. The respective responsibilities of the Processor and subcontractor must be clearly delineated.
  • 7.5. The subcontractor may not engage further subcontractors.
  • 7.6. The Processor shall select subcontractors carefully, with particular regard to the suitability of the technical and organisational measures adopted by the subcontractor.
  • 7.7. Data processed on behalf of the Controller may be transferred to the subcontractor only once the Processor has documented its determination that the subcontractor has fully complied with its obligations. The Processor shall provide this documentation to the Controller without being asked.
  • 7.8. Subcontractors who do not perform processing exclusively within the EU or EEA may be engaged only subject to compliance with Part IV Clauses 4.10 and 4.11 of this Agreement. In particular, engagement is permitted only insofar as and for as long as the subcontractor provides adequate data protection safeguards. The Processor shall inform the Controller of the specific safeguards provided and how evidence of them may be obtained.
  • 7.9. The Processor shall appropriately review the subcontractor's compliance with its obligations on a regular basis, at least every 12 months. The review and its results must be documented sufficiently to be comprehensible to a knowledgeable third party. Documentation shall be prepared through an audit made available in the system, conducted by the Vendor as a self-audit.
  • 7.10. Where the subcontractor fails to comply with its data protection obligations, the Processor shall be liable to the Controller for such failure.
  • 7.11. The subcontractors identified in Annex 2 by name, address and scope of engagement are currently engaged in personal data processing to the extent specified there and have been approved by the Controller. The Processor's other obligations in relation to subcontractors set out herein remain unaffected.
  • 7.12. Sub-processing arrangements within the meaning of this Agreement are only those services directly connected with provision of the principal service. Ancillary services such as transport, maintenance and cleaning, and the use of telecommunications services or user support are not covered. The Processor's obligation to ensure compliance with data protection and data security requirements in such cases remains unaffected.

8. Rights and Obligations of the Controller

  • 8.1. The Controller is solely responsible for assessing the lawfulness of commissioned processing and safeguarding the rights of data subjects.
  • 8.2. The Controller shall document all engagements, partial engagements and instructions. In urgent cases, instructions may be given orally. Such instructions shall be confirmed in documented form by the Controller without undue delay.
  • 8.3. The Controller shall notify the Processor without undue delay if it identifies errors or irregularities when reviewing processing results.
  • 8.4. The Controller is entitled, to a reasonable extent and either itself or through third parties, to verify the Processor's compliance with data protection law and contractual arrangements, in particular by obtaining information, inspecting stored data and data processing programs and conducting other on-site audits. The Processor shall grant auditors access and inspection rights as necessary and shall provide information, demonstrate procedures and produce evidence necessary for the audit.

9. Instructions

  • 9.1. The Controller reserves comprehensive rights to issue instructions in relation to commissioned processing.
  • 9.2. The Controller and Processor shall specify in Annex 3 the persons exclusively authorised to issue and receive instructions.
  • 9.3. In the event of a change or prolonged absence of a designated person, the other party must be notified of the successor or substitute without undue delay.
  • 9.4. The Processor shall notify the Controller without undue delay if, in its opinion, an instruction given by the Controller infringes statutory provisions. The Processor may suspend implementation of the instruction until it has been confirmed or amended by the responsible person at the Controller.
  • 9.5. The Processor shall document instructions received and their implementation.

10. Remuneration

The Processor's activities and measures within the scope of commissioned processing shall be provided free of charge. No remuneration shall be payable.

11. Special Termination Right

  • 11.1. The Controller may terminate the Main Agreement and this Agreement at any time without notice ("extraordinary termination") if the Processor commits a material breach of data protection law or this Agreement, is unable or unwilling to comply with a lawful instruction from the Controller, or wrongfully refuses the Controller's audit rights.
  • 11.2. A material breach shall exist in particular where the Processor fails, or has failed, to perform to a significant extent the obligations laid down in this Agreement, especially the agreed technical and organisational measures.
  • 11.3. In the case of minor breaches, the Controller shall grant the Processor a reasonable period to remedy the breach. If the breach is not remedied in time, the Controller may terminate extraordinarily as described in this section.
  • 11.4. The Processor shall reimburse the Controller for all costs arising from premature termination of the Main Agreement or this Agreement as a result of extraordinary termination by the Controller.

12. End of Processing Engagement

  • 12.1. Upon termination of the processing relationship, or at any time upon the Controller's request, the Processor must, at the Controller's option, destroy or return the data processed on its behalf. All existing copies must also be destroyed. Destruction must prevent the reconstruction of residual information using reasonable efforts. Physical destruction shall be carried out in accordance with DIN 66399, at least protection class 2.
  • 12.2. The Processor shall procure prompt return or deletion also by subcontractors.
  • 12.3. The Processor must provide evidence of proper destruction and submit it to the Controller without undue delay.
  • 12.4. Documentation evidencing proper processing must be retained by the Processor in accordance with applicable retention periods after expiry of this Agreement. The Processor may hand such documentation to the Controller upon termination as evidence in its own defence.

13. Liability

  • 13.1. The Processor bears the burden of proving that damage was not caused by circumstances for which it is responsible, insofar as the relevant data were processed by it under this Agreement. Until such proof is furnished, the Processor shall indemnify the Controller against all claims brought against the Controller in connection with commissioned processing. Under these conditions, the Processor shall also reimburse all legal defence costs incurred by the Controller.
  • 13.2. The Processor is liable to the Controller for damage culpably caused by the Processor, its employees, persons engaged by it to perform this Agreement or sub-processors engaged by it in connection with the provision of the contractual services.
  • 13.3. Part IV Clauses 13.1 and 13.2 shall not apply where damage results from proper performance of the commissioned service or an instruction issued by the Controller.

14. Rules on Rectification, Deletion and Blocking of Data

  • 14.1. The Processor shall rectify, delete or block data processed under the engagement only in accordance with the contractual arrangements or the Controller's instructions.
  • 14.2. The Processor shall comply with the Controller's corresponding instructions at all times, including after termination of this Agreement.

15. Contractual Penalty

For every culpable breach of an obligation under this Data Processing Agreement, the Processor undertakes to pay the Controller a contractual penalty, the amount of which shall be determined by the Controller in its reasonable discretion and subject to judicial review in the event of a dispute. Claims exceeding the amount of the contractual penalty remain unaffected. The contractual penalty shall not affect any other claims of the Controller.

16. Transfers to Third Countries

To ensure an adequate level of data protection when transferring personal data to third countries, Copecart GmbH uses the Standard Contractual Clauses approved by the European Commission. These clauses govern the processing of personal data by our processors and ensure compliance with the data protection provisions of both the EU and the respective third country." Furthermore, reference is made to our Terms and Conditions and our Privacy Policy.

17. Miscellaneous

  • 17.1. Both parties undertake to keep confidential any knowledge obtained during the contractual relationship concerning the other party's trade secrets and data security measures, including after termination of the Agreement. Where there is doubt as to whether information is subject to confidentiality, it shall be treated as confidential until released in writing by the other party.
  • 17.2. If property belonging to the Controller and held by the Processor is jeopardised by third-party measures (e.g. attachment or seizure), insolvency or composition proceedings, or other events, the Processor shall notify the Controller without undue delay.
  • 17.3. Ancillary agreements must be in writing.
  • 17.4. The defence of a right of retention under Section 273 BGB is excluded in relation to data processed on behalf of the Controller and the associated data carriers.
  • 17.5. Should individual parts of this Agreement be invalid, the remaining provisions shall remain effective.

Annex 1 – Technical and Organisational Measures The following sets out the technical and organisational measures relating to the engagement that the Processor must implement as a minimum and maintain on an ongoing basis to ensure data protection and security. The objective is in particular to ensure the confidentiality, integrity and availability of information processed on behalf of the Controller. Confidentiality (Article 32(1)(b) GDPR)

  • Physical access control No unauthorised access to data processing facilities, e.g.: magnetic or chip cards, keys, electric door openers, security guards or reception staff, alarm systems, video surveillance;
  • System access control No unauthorised use of systems, e.g.: secure passwords, automatic locking mechanisms, two-factor authentication, encryption of data carriers;
  • Data access control No unauthorised reading, copying, modification or removal within the system, e.g.: authorisation schemes, access rights allocated on a need-to-know basis, access logging;
  • Separation control Separate processing of data collected for different purposes, e.g. tenant segregation, sandboxing;
  • Pseudonymisation (Article 32(1)(a) GDPR; Article 25(1) GDPR) Processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided such additional information is kept separately and is subject to appropriate technical and organisational measures;

Integrity (Article 32(1)(b) GDPR)

  • Transfer control No unauthorised reading, copying, alteration or removal during electronic transmission or transport, e.g.: encryption, virtual private networks (VPN), electronic signatures;
  • Input control Identification of whether and by whom personal data have been entered into, modified in or removed from data processing systems, e.g.: logging, document management;

Availability and resilience (Article 32(1)(b) GDPR)

  • Availability control Protection against accidental or intentional destruction or loss, e.g.: backup strategies (online/offline; on-site/off-site), uninterruptible power supply (UPS), antivirus software, firewalls, reporting channels and emergency plans;

Rapid restorability (Article 32(1)(c) GDPR); procedures for regular testing, assessment and evaluation (Article 32(1)(d) GDPR; Article 25(1) GDPR)

  • Data protection management;
  • Incident response management;

Privacy-friendly default settings (Article 25(2) GDPR);

  • Commissioning control:
  • No commissioned data processing under Article 28 GDPR without corresponding instructions from the Controller, e.g.: clear contractual arrangements, formalised engagement management, rigorous service provider selection, prior verification obligations, follow-up checks.

Annex 2 – Approved Sub-processors:

  • Sub-processor: Marketing MBA, Office 1906 Jumeirah Business Center 3, Cluster Y, Jumeirah Lake Towers, Dubai, United Arab Emirates. rp@aiv.group (CEO Raoul Plickat)

Tools and software used by the sub-processor in which personal data are processed:

  • Slack Technologies Limited: Salesforce Tower 60 R801, North Dock Dublin Ireland privacy@slack.com

  • Monday.com: MondayCom Ltd, 6 Yitzhak Sadeh Street, Tel Aviv-Yafo, 677750 https://monday.com/helpcenter/

  • Notion: Hendrik Beck & Sascha Rehbock GbR, Hanauer Str.3, 61118 Bad Vilbel info@getgamma.app

  • Google: Google Workspace Google Analytics Google Tag Manager Google Ireland Limited Gordon House, Barrow Street Dublin 4 Ireland support-deutschland@google.com

  • Zoom: Zoom Video Communications, Inc. 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA privacy@zoom.us

  • Calendly: Calendly LLC,1315 Peachtree St NE, Atlanta, GA 30309, USA privacy@calendly.com

  • WebinarJam: 7660 Fay Ave Ste H184, La Jolla, California, 92037, United States support@webinarjam.com

  • Close CRM: Elastic Inc, PO Box 1145, Jackson, WY 83001, USA dpo@close.com

  • Keeping: Katsu Ventures LLC, 90 State Street, Suite 700, Albany, NY 12207 support@keeping.com

  • Active Campaign: Active Campaign LLC, 1 N Dearborn St Fl 5, Chicago, Illinois, 60602, United States help@activecampaign.com

  • WebSMS: LINK Mobility Austria GmbH, Brauquartier 5/13, 8055 Graz, AUSTRIA office.at@linkmobility.com

  • Slido: Cisco Systems, Inc., Legal department, 170 West Tasman Dr., San Jose, CA 95134 USA support@slido.com

  • Jotform: Jotform Inc. 4 Embarcadero Center, Suite 780, San Francisco CA 94111 support@jotform.com

  • WebFlow: WebFlow Inc, 398 11th Street, Floor 2, San Francisco, CA 94103 support@webflow.com

  • clickfunnels: Clickfunnels LLC, 3443 W Bavria St, Eagle, Idaho 83616, US support@clickfunnels.com

  • funnelcockpit: Denis Hoeger Caballero, Nobelstr- 3-5, 41189 Mönchengladbach, Germany support@funnelcockpit.com

  • Kajabi: Kajabi LLC, 333 El Camino Real Ste 200 Tustin California 92780, US support@kajabi.com

  • AcademyOcean: Netpeak Group Ltd., 43 Cherni Vrah bld, Sofia, Bulgaria gdpr@netpeak.net

  • Copemember: CopeMember Technology Ltd., Gialousas 63, 3071 Limassol, Cyprus info@copemember.com

  • Copecart: CopeCart GmbH, Rosenstraße 2, 10178 Berlin, Germany info@copecart.com

  • matomo: Matomo Ltd., 150 Willis St, Mount Victoria, 6011, New Zealand privacy@matomo.org

  • cookiebot: Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark mail@cookiebot.com

  • Hotjar: Hotjar Ltd., Dragonara Business Centre 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141 Malta support@hotjar.com

  • zapier: Zapier, Inc. 548 Market St. #62411. San Francisco, CA 94104-5401, USA contact@zapier.com

  • vimeo: Vimeo Inc., 330 W 34th St Fl 5, New York City, New York, 10001, USA support@vimeo.com

  • vidalytics: Vidalytics LLC, 340 S Lemon Ave, Walnut, California, 91789, USA hi@vidalytics.com

Annex 3 – Persons Authorised to Give Instructions

  • The following persons are authorised to issue and receive instructions: the controller within the meaning of Article 4(7) GDPR.

Annex 4 – Data Protection Officer

  • The following external data protection officer is currently appointed for the Processor:
  • Williams-Connect Management Janko Williams Straße der Jugend 18 14974 Ludwigsfelde kontakt@williams-connect.eu

PART V - Processing of Personal Data by CopeCart GmbH

1. Subject Matter of the Engagement

  • 1.1. The Vendor (the "Controller" for the purposes of this Part V) has CopeCart GmbH (the "Processor" for the purposes of this Part V) process personal data on its behalf on the basis of the agreement for use of the copecart.com platform (the "Main Agreement"). For this purpose, the parties conclude this Data Processing Agreement, which takes precedence over the Main Agreement in the event of conflicts. Processing on behalf of the Controller within this meaning by the Processor exists insofar as the Processor processes personal data through copecart.com for which the Processor is the controller within the meaning of Article 4 GDPR.
  • 1.2. The data concerned are those of the Controller and its customers. They include, in particular, names, addresses, communications data, behavioural data, contractual data and payment data.

2. Responsibility and Rights of Instruction of the Controller

  • 2.1. For the purposes of commissioned processing, the Controller is the controller within the meaning of Article 4(7) GDPR. It is responsible for compliance with statutory data protection provisions, particularly the lawfulness of transmitting data to the Processor and the lawfulness of the processing by the Processor.
  • 2.2. The Controller has the right at any time to issue supplementary instructions regarding the nature, scope and procedure of personal data processing under the Main Agreement. Instructions shall be issued through the copecart.com website where possible, otherwise in text form. Instructions not covered by the agreement for use of copecart.com shall be subject to payment to the extent that remuneration for them is customary.
  • 2.3. The Processor shall inform the Controller without undue delay in text form if it considers an instruction given by the Controller to breach statutory provisions. Pending resolution of the Processor's concerns by the parties, the Processor may suspend implementation of the instruction. If the parties are unable to agree and the Controller insists on its instruction, the Processor may terminate this Agreement on reasonable notice, which should not be less than two weeks. If the Main Agreement cannot be performed in such circumstances, the Controller may terminate it where performance would be possible only by carrying out the unlawful instruction and neither party could have anticipated this when concluding the Agreement.
  • 2.4. Where the Processor considers that it cannot comply with an instruction of the Controller for technical reasons, it shall notify the Controller in text form and consult with it concerning further action.

3. Audit Rights of the Controller

  • 3.1. The Controller shall have all audit rights, including inspections, necessary to discharge its obligations under the GDPR. Such rights must be exercised upon reasonable prior notice and during the Processor's usual business hours. To minimise disruption of its operations, the Processor may combine inspections with those of other controllers where reasonable for the Controller (e.g. joint inspection dates arranged within a reasonable period). The Controller shall ensure that audits are conducted only to the extent necessary so as not to interfere disproportionately with the Processor's operations.
  • 3.2. The Controller may delegate the exercise of its audit rights to a third party appointed by it. Where that third party competes with the Processor, the Processor may object to its involvement.
  • 3.3. The Processor shall cooperate as necessary with the exercise of audit rights. The Processor may require the Controller to sign a customary and reasonable confidentiality undertaking where required by law to protect the Processor's trade secrets.
  • 3.4. The Processor shall be entitled to reasonable remuneration based on time spent for services provided under this Clause unless it is responsible for the audit or the audit is conducted or ordered by a supervisory authority. The Processor may not make its performance conditional on the Controller acknowledging a particular remuneration amount or paying it in advance.

4. Obligations of the Controller

The Controller shall inform the Processor without undue delay, specifying the reasons, if it identifies errors or irregularities in processing results or the Processor's activities in relation to this Agreement or the GDPR.

5. Obligations of the Processor

  • 5.1. All personal data shall be processed exclusively in accordance with the Main Agreement and any instructions given by the Controller. This also applies to transfers of personal data to a third country or international organisation. This Part V Clause 5.1 does not apply where the Processor is required to process data under Union or Member State law to which it is subject; in such case, the Processor shall inform the Controller of the legal requirement before processing unless the law prohibits such notification on important grounds of public interest.
  • 5.2. The Processor confirms that it is not legally obliged to appoint an internal data protection officer. Instead, it shall designate a contact person for all matters concerning data protection and performance of this Agreement.
  • 5.3. The Processor shall bind persons authorised to process personal data to confidentiality unless they are already subject to an appropriate statutory duty of secrecy. The scope of the undertaking must be proportionate to the data processed and the consequences of a possible data breach. It must also cover all personal data processed by the Processor for the Controller. Upon request, the Processor shall demonstrate the content and existence of the undertaking to the Controller. Any more extensive obligations arising under a separate confidentiality agreement between the parties remain unaffected.
  • 5.4. The Processor shall provide its record of processing activities carried out on behalf of the Controller upon request and shall inform the Controller in text form of any subsequent changes without being asked.
  • 5.5. The Processor shall assist the Controller in complying with its obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it. In particular, it shall provide the services set out in this Agreement.
  • 5.6. Where necessary, the Processor shall assist the Controller in conducting a data protection impact assessment under Article 35 GDPR and provide all relevant information and evidence within its control. The same obligation applies where the Controller must conduct prior consultation with a supervisory authority under Article 36 GDPR. The Processor shall be entitled to reasonable remuneration based on time spent for the services provided under Part V Clause 5.6. The Processor may not make performance conditional on the Controller acknowledging a particular remuneration amount or paying it in advance.
  • 5.7. Upon a justified request from the Controller, the Processor shall provide all information needed to demonstrate compliance with its obligations under Article 28 GDPR.
  • 5.8. If the Controller's data held by the Processor are endangered by attachment, seizure, insolvency or composition proceedings, or other events or third-party measures, or if such measures have occurred, the Processor shall inform the Controller fully and without undue delay unless prohibited by law. The Processor is further obliged to inform relevant third parties that the data are personal data for which the commissioning party is the controller and that it acts only as processor.

6. Security of Processing

  • 6.1. The Processor shall adopt all measures required by Article 32 GDPR, in particular appropriate technical and organisational measures, to ensure security proportionate to the risk of processing. Upon request, it shall demonstrate compliance to the Controller by suitable means.
  • 6.2. The Processor may adapt measures to changing technical or legal conditions. It shall notify the Controller without undue delay of changes that could reduce the level of protection.

7. Sub-processors

  • 7.1. The Processor uses sub-processors for processing and informs the Controller thereof.
  • 7.2. The Processor shall inform the Controller in text form of changes in the engagement of sub-processors. The Controller may object to the change within two weeks after receipt of the information. The Processor shall not implement the change before expiry of the objection period. In the event of an objection, the Processor may terminate the Data Processing Agreement on at least one month's notice if the change would have been reasonable for the Controller and the objection would be unreasonable for the Processor. The change shall be reasonable for the Controller where no disadvantages are expected and, in particular, continued compliance with this Agreement and the GDPR is assured. The objection shall be unreasonable for the Processor where it provides essentially standardised processing services for a large number of controllers and individual deviations concerning sub-processors cannot easily be implemented (e.g. all controllers use the same standardised software platform).
  • 7.3. In relation to any sub-processors, the Processor shall comply with Article 28(2) and (4) GDPR. It must also ensure that any other relevant contractual arrangements with the Controller and supplementary instructions by the Controller are complied with by sub-processors. It shall demonstrate this to the Controller upon request.

8. Measures by Supervisory Authorities

  • 8.1. Insofar as permitted, the Processor shall inform the Controller without undue delay of inspections and measures by a (supervisory) authority relating to this Agreement. This applies in particular where an authority investigates the Processor in administrative offence or criminal proceedings relating to commissioned processing.
  • 8.2. Where the Controller is itself subject to inspection by a (supervisory) authority, administrative offence or criminal proceedings, a liability claim by a data subject or third party, or another claim relating to processing by the Processor, the Processor shall assist it as necessary. The Processor is entitled to reasonable remuneration based on time spent for such services unless and to the extent that it is responsible for the respective inspection or proceedings. The Processor may not make its performance conditional on the Controller acknowledging a particular remuneration amount or paying it in advance.

9. Remuneration of the Processor

The Processor shall not receive separate remuneration for services provided under this Agreement unless otherwise provided herein.

10. Term of the Agreement

The term of this Agreement follows that of the Main Agreement. It may be terminated separately from the Main Agreement only for good cause unless this Agreement or mandatory statutory provisions provide otherwise.

11. Consequences of Termination

  • 11.1. Upon completion of processing services, the Processor shall, at the Controller's option, delete or return all personal data and erase existing copies, unless Union or Member State law applicable to the Processor requires their retention. The Processor shall confirm to the Controller that deletion has been carried out in accordance with its instructions.
  • 11.2. The Controller has the right to audit the complete and contract-compliant return and deletion of data by the Processor.
  • 11.3. Any right of retention of the Processor in relation to the processed data and associated data carriers is otherwise excluded.

12. Liability

The parties' liability is governed by the Main Agreement. Their direct statutory data protection liability towards data subjects remains unaffected.

13. Breach of Data Protection Provisions, Agreements or Instructions

  • 13.1. The Processor shall notify the Controller in text form of any breach of data protection provisions, contractual arrangements and/or instructions without undue delay and no later than 24 hours after first becoming aware of it. The notification should contain at least:
    • 13.1.1. A description of the nature of the breach, where possible specifying the nature and quantity of affected data and categories of data subjects;
    • 13.1.2. The name and contact details of the data protection officer or another point of contact for further information;
    • 13.1.3. A description of the likely consequences of the personal data breach;
    • 13.1.4. A description of the measures taken or proposed by the controller to remedy the personal data breach and, where applicable, mitigate its possible adverse effects;
  • 13.2. Any required notification to a supervisory authority or information to data subjects shall be the Controller's sole responsibility. The Processor shall provide necessary assistance.
  • 13.3. The Processor shall further investigate the breach without undue delay as necessary and provide the Controller with corresponding documentation. The documentation must describe the measures taken by the Processor to prevent further breaches and why it considers them sufficient to comply with this Agreement and statutory requirements.

14. Data Subject Rights

  • 14.1. Insofar as possible and reasonable, the Processor shall assist the Controller through appropriate technical and organisational measures in fulfilling its obligation to respond to requests to exercise rights under Chapter III GDPR. For this purpose, the Controller shall notify the Processor in text form of the assistance required and provide the data necessary to fulfil the request. Where either party requires further information from the other, it shall notify the other without undue delay in text form. The Processor shall provide assistance within a reasonable period enabling the Controller to meet its deadlines. If it cannot provide the assistance requested, it shall notify the Controller without undue delay and state the reasons.
  • 14.2. If a data subject contacts the Processor directly to exercise rights under Chapter III GDPR, the Processor shall refer the data subject to the Controller insofar as attribution is possible. If attribution is not possible and the Processor is not itself directly obliged to the data subject as controller under Chapter III GDPR, it shall inform the data subject that it acts as processor for third parties and cannot identify the third party in relation to the data subject. Where the Processor itself has obligations towards the data subject as controller under Chapter III GDPR, it alone shall be responsible for fulfilling them.
  • 14.3. The Processor shall be entitled to reasonable remuneration based on time spent for services provided to the Controller under this Part V Clause 14. The Processor may not make its performance conditional on the Controller acknowledging a particular remuneration amount or paying it in advance.
Loading...
Your browser is out of date!
Update your browser to view this website correctly.
Close