General Terms and Conditions for Vendors and/or Affiliates

These General Terms and Conditions for Vendors and/or Affiliates are divided into three parts:

PART I General Terms and Conditions for Vendors - these apply if you want to offer products as a UAE vendor through copecart.com;
Part II General Terms and Conditions for Affiliates - these apply if you want to advertise products of our Vendors as an Affiliate;
Part III General Regulations for Vendors and Affiliates - these apply to both Vendors and Affiliates;

PART I General Terms and Conditions for Vendors

1. registration as well as modification and cancellation of a registration, participation fee

Registration as a vendor is only possible for UAE based companies. For the registration you have to provide truthful information. We are entitled to have their correctness as well as the entrepreneurial status proven by suitable evidence. We are also entitled to reject an application for registration without giving reasons.
If your information changes, you must update it immediately on our website.
Each party may terminate a completed registration properly at any time at the end of the paid membership. Free memberships can be terminated at any time. This does not affect the obligation to perform the purchase contracts concluded under the validity of this contract. This contract applies accordingly to these subsequent obligations until they are fulfilled. The right to terminate for cause remains unaffected.

2. offering products and services, transfer of rights

Upon registration, you are authorized to offer products and services (collectively "Products") through copecart.com. Although the transaction is between you and the buyer, we, as an e-marketplace are the access point of your products and services to purchasers (the "end customers"), and thus their contractual partners. If an End Customer wishes to conclude a contract for the purchase of a Product, a contract is first concluded between the End Customer and us and then, as a covering transaction, a corresponding contract is concluded between us and you. Consequently, no direct contract is concluded between you and an end customer for the purchase of a product.
We will promote and offer your products at our discretion. We will provide technical functions for the sale of the products at our discretion, which will enable you or the affiliates to make a sale also on other websites or by other means (e.g. telephone sales). In these cases, too, we will always be the contractual partner of an end customer, and such a sale must be made in accordance with these Terms and Conditions. There is no claim that all products are always advertised and offered.
If we believe, in our sole discretion, that you are in violation of the terms of this Agreement and that we cannot reasonably be expected to offer your Products, we will block access to your Products and notify you of such blocking and the reasons therefor.
You warrant that your products may be marketed and offered within the selected territory including but not limited to the United Arab Emirates and the European Union and comply with all relevant legal requirements. The corresponding obligation also exists for all other countries in which your products are offered
If you want to offer a product through us, you have to provide all information requested by us in the corresponding input mask. This includes in particular the following information:
- Name of the product
- Price;
- Product Description;
- Availability and delivery times;
- shipping costs, if applicable;
- information required by law, which must be observed when advertising the product;
- Texts and images for free promotion of the product;
The information or data provided by you shall be updated immediately upon any change and shall comply with the legal requirements at all times. You will inform us immediately if any of your products do not meet the legal requirements or the requirements of this contract or if third parties claim this or a violation of their rights.
You are liable for incorrect or incomplete information or data transmitted. Therefore, please check after placing your product that all required information has been included and that it is correct. You have to enable us through your information to offer and advertise each of your products in compliance with the law.
You may not advertise or cause to be advertised that copecart recommends or otherwise promotes its products.
If we are dependent on your cooperation in order to process customer inquiries, complaints, notices of defects or other exercises of rights by customers, you shall provide this cooperation immediately and free of charge.
You transfer to us, free of charge, the worldwide rights to the information, data and, if applicable, other content made available to us as part of the placement of a product, to use these for the purposes of implementing this contract and, in particular, to advertise and sell the products in online and offline media. This grant of rights includes in particular all forms of offering and advertising the products on websites, in social media offerings, blogs, by telephone, by video conference, price search engines and other internet offerings as well as apps. You warrant that you will transfer to us the rights required for this purpose free of any third party rights that may prevent use in accordance with the contract. Upon termination of the contract, we are not obligated to recall advertising for products that has already been published using the rights transferred above or to remove public access to it again (e.g., advertising in social media offerings).

3. distribution of digital products

If your product can be sent by us in digital form or made accessible by means of a link, the corresponding content or access must be made available to us by you when you place the product.
We are entitled for these products according to the possibilities offered by you to grant end customers access to them or to provide them with them and to allow them to store them permanently. This includes the right of duplication, making available to the public, making available on demand, distribution and reproduction by means of all technical and economic forms of exploitation and distribution. Insofar as it is technically necessary for the execution of the contract or is required for economic exploitation, we shall be entitled to process the product to the extent necessary.

4. cover business for products and services sold

If an end customer purchases a product offered by you from us, we acquire the corresponding product from you as a covering transaction and instruct you to fulfill the corresponding contract between us and the customer. If the fulfillment of the contract takes place by sending a digital content or a link, we fulfill the contract between us and the end customer to that extent.
If a product can be purchased in return for several payment installments (e.g., recurring payment for access to digital content), we will purchase the product over time in accordance with the payment installments and not immediately for the entire term. If the end customer defaults on payment of the additional fee installments, you will not acquire the product until we receive the corresponding amounts.
We will provide the end customer with with product information you provide to us.
The conclusion of the covering transaction shall take place immediately and automatically without any separate declaration being required on your part. Both parties insofar waive the receipt of the respective declarations for the conclusion of the contract. We will inform you about the conclusion of a respective covering transaction by means of an email containing all relevant data. In addition, you can also access the relevant contract conclusions on our website
From the conclusion of the covering transaction you are entitled to the sales price stated by you and charged to the end customer less billing charges and our commission fee of 7.9% + a $1 fee per transaction (or as otherwise agreed in writing).. Of this amount, 80% will be released for payment after the end customer's 14-day cancellation period has expired and the remaining amount will be released for payment after a further 40 days, provided we have received the money from the end customer. The payment will be made to the account or similar specified by you on our website. The payment to which you are entitled is subject to the applicable sales tax, provided that you have entered your valid sales tax identification number in your profile in good time before the invoice is issued. A subsequent claim for correction of the invoice does not exist. If you have agreed to the initiation of collection measures against an end customer who is in default of payment, you shall bear the costs of the collection procedure specified by us in this connection.
The payment of the purchase price requires that you have indicated in their profile whether they are liable to VAT and you have indicated your VAT ID, if any.
Should you not be able to deliver ordered products or not be able to deliver them within the respective communicated delivery time, you have to inform us immediately. In this case, we are entitled to withdraw from the affected contract with you.

5. copeMember

Upon successful registration, a Vendor has access to CopeMember within the scope and limits of the free usage model offered by us as part of Copecart in the future. This may only be used by the Vendor for the fulfillment of Cover Business as defined in Section 4, i.e. for end customers of the Vendor's products sold by Copecart.
Any further use of CopeMember or use for other purposes requires a CopeMember package for which a fee is charged.
The Vendor is responsible for the contents published in CopeMember, including those of the End Customers, and shall indemnify Copecart against any justified claims by third parties (e.g. due to infringement of third party rights or other unlawful contents). The use of CopeMember is subject to the order processing agreement pursuant to Section IV.

6. joint ventures of vendors

Two Vendors may enter into a so-called Joint Venture for a Product according to the features we offer. The applicant for the establishment of a joint venture is the Vendor offering the Product (the "Applicant"). The Applicant remains our contractual partner for the respective Product in accordance with these Terms and Conditions. However, a reduction of the consideration due to him from the sale of the Product shall be agreed upon in accordance with the Application for the establishment of the Joint Venture. We are entitled to reject such an application without giving reasons.
Upon establishment of the joint venture, the amount by which the claimant's remuneration claim has been reduced shall be due to the vendor designated by the claimant ("beneficiary"). The beneficiary acquires this claim for payment directly against us. The payer is therefore not the Applicant, but CopeCart. If we have a claim against the Applicant for repayment of the remuneration paid to the Applicant under the Joint Venture in whole or in part, we shall also have such claim against the Beneficiary.
We are not a party to the contract that the applicant and beneficiary enter into for the purposes of the joint venture.
A joint venture may be terminated at any time without notice.

7. prohibited products

It is forbidden to offer or promote products that are not in line with the legal and ethical requirements of the United Arab Emirates and the territoris in which you distribute your products: Furthermore, the following product categories may not be offered:

sexually offensive products;
Alcohol, tobacco and medications;
Products that discriminate against third parties on the basis of race, gender, religion, nationality, disability, sexual orientation or age;
products that infringe third-party rights, in particular trademarks, patents or other industrial property rights;
Products for which legal advertising bans or restrictions exist;
Products that may only be sold to end customers after an age check has been carried out
all products prohibited by law;

8. disbursements, taxes and duties

For the payment of fees due to you, you must first go through our verification process (Know Your Customer - KYC), carried out by our payment partner STRIPE This is similar to the identification process that banks regularly require from their customers to prevent money laundering and ensures that you or your company (natural person or legal entity) are the authorised payee. Before payment of the fees due to you, you must also provide proof of your entrepreneurial status and of the payment of VAT by you or of your exemption from VAT (small business regulation). If, due to the location of your company, further proof is required in order to be able to make payments to you (e.g. for the prevention of money laundering), these documents must also be submitted to us in advance.
If we are obliged to withhold taxes or duties for fees payable to you, the fee payable to you will be reduced accordingly and we will make the corresponding payments to the competent authority. In all other respects, the proper taxation of your income is your sole responsibility.

9. reversal of a covering transaction

If an end customer effectively cancels the contract for the purchase of a product, we are entitled to cancel the corresponding covering transaction with you accordingly as well.
The same applies if an end customer is entitled to cancel a contract for the purchase of one of your products for other reasons for which we are not responsible (e.g. due to default in performance or defects).

10. shipping physical products

You shall immediately ship physical products that we have purchased from you as a covering transaction to the end customer. The shipment is at your expense and risk. You should therefore insure the shipment. You indemnify Copecart against all potential claims arising from your shipment and logistical processes around the provision of your products.

11. data protection, use of customers for advertising purposes, double opt-in

When placing a product, you must state truthfully and in accordance with the statutory regulations which personal data of an end customer you require from us in order to be able to fulfill the covering transaction vis-à-vis the end customer. Insofar as we transmit personal data of an end customer to you, you may only process this data for the fulfillment of this purpose or if you are otherwise legally entitled to process it accordingly.
You are also prohibited from processing the personal data of end customers in a manner that violates data protection laws, and violations of this provision entitle us to terminate the contractual relationship with you without notice. Further claims remain unaffected.
You are only permitted to use personal data of end customers for advertising purposes if the legal requirements for this are met. From the possible transmission of contact data by us, the authorization to use these for advertising measures, e.g. email newsletters, cannot be derived without the existence of the necessary prerequisites. If we inform you that one of your customers has given us permission to receive a newsletter from you by email, we will not verify this opt-in by means of a double opt-in. We therefore recommend that you carry out a double opt-in on your own in order to be able to provide the evidence required by law for the granting of an opt-in. Otherwise, you may not be able to prove that a customer has effectively consented to receive promotional emails.
We offer the possibility to transfer personal data of our end customers provided to you to further internet offers (e.g. newsletter tools). It is your responsibility to create the data protection basis for this transfer and to conclude any necessary agreements between you and the recipient of the data.

12. use of "copecart" and "copecart.com" respectively

We allow you to use the name "copecart" or "copecart.com" only as far as it is necessary to indicate for a product in a usual way that it can be purchased via copecart.com. Any further use of our trademarks requires our prior permission.

13. activation of affiliate campaigns

Within the scope of the possibilities granted by copecart.com in each case, you may grant third parties (so-called marketing affiliates or just affiliates) the opportunity to advertise products offered by you. The design of the corresponding Affiliates program as well as the selection of the participating Affiliates is at our discretion. We are a contractual partner of the Affiliates and are entitled at any time not to activate, to restrict or to terminate advertising measures.
If you wish to grant corresponding advertising opportunities, you undertake to provide only truthful, non-misleading information in this respect, which enables the advertising measure to be implemented in compliance with the law. You are not entitled to grant the Affiliates incentives or promotions for the advertising measures outside of copecart.com.
Within the framework of an advertising campaign, you may provide for remuneration for the Affiliate, the debtor of which vis-à-vis the Affiliate shall initially be us upon the occurrence of the prerequisites necessary for the due date. We charge these commissions paid to the affiliates on your behalf to you and offset them against the payment claims due to you against us.

14. third party services

We offer, at our discretion, the ability to transmit data from your account to or receive data from services offered by third parties. We ourselves are not a provider of these services and are not responsible for them.
You shall conclude the necessary contracts yourself in order to use the services of the third parties and shall be obliged to use them in compliance with their contractual and legal obligations.

Part II General Terms and Conditions for Affiliates

15. definitions

For purposes of this Part II, the following definitions apply:

"Advertisers" are the Vendors who offer products through copecart.com and who provide advertising materials for them to be published by Affiliates.
"Affiliates" are parties who wish to publish advertisements and/or affiliate links provided by Advertisers.
"Technical protection measures" are measures to determine whether an advertisement has been clicked by a user on a particular advertising space, as well as measures to prevent such clicks from being faked or abused.
"Users" are natural persons who do not visit or otherwise become aware of an Advertising Space for the purpose of generating revenue for the Publisher or other third parties.
"Advertising Materials" are those which Advertisers provide.
"Advertising Space" means space operated by and for which Affiliate is responsible for the publication of advertising on websites on the Internet, in apps or other digital offerings in which advertising space is made available.
"Advertising campaigns" are temporary advertising activities by advertisers for which advertisements are provided.

16. registration as well as modification and cancellation of a registration,

For the registration you have to provide truthful information. We are entitled to have their accuracy as well as the entrepreneurial status proven by suitable evidence. We are also entitled to reject an application for registration without giving reasons.
If your information changes, you must update it immediately on our website.
Either party may terminate a completed registration as an Affiliate with one week's notice.

17. participation in the affiliate program

Affiliates are obligated to integrate advertising media in a legally compliant manner and only on such advertising spaces that are designed and operated in accordance with the applicable legal requirements. You are not entitled to provide information about the advertised products that deviates from the information provided by us. This applies in particular to the description of the products or the rights to which the buyer is entitled.
It is prohibited to publish advertising material on advertising spaces that are likely to endanger our reputation or that of the advertiser.
Furthermore, it is not permitted to show the advertising material on advertising spaces of the following offers:
- Offers that directly or indirectly enable the possibility of downloading or streaming legally protected content without the consent of the owners of the rights to this content;
- Offers that represent the following: Forced-click systems, cashback or bonus systems, Paid4 leads (Paidmailer, Paid-Clicks, Paid-Leads), temporary e-mail addresses, promotional clicks for SMS dispatch, banner network or banner exchange systems as well as "banner farm" sites, websites which consist only of advertising banners, ViewBar lead/sale programs in popup/frame, entry services for sweepstakes);
Advertising media that are placed contrary to the above specifications do not trigger any claims for remuneration, entitle us to terminate the contract for good cause and may trigger claims for damages.
Advertising materials may only be used in the manner in which they are provided by us. If these are provided together with technical protection measures, they may only be used together with these as specified by us.

18. participation in advertising campaigns, use of advertising materials, remuneration

It is possible for the Affiliate to participate in the advertising campaigns provided by the advertisers if we provide him with the corresponding advertising media. There is no claim to be able to participate in a certain advertising campaign or to be allowed to use a certain advertising material.
We are entitled to terminate individual advertising media or campaigns at any time, even prematurely.
Advertising materials including technical protection measures are to be properly used for the advertising spaces in accordance with our specifications.
The Affiliate does not receive any remuneration for the integration of an advertising medium on an advertising space. He is only entitled to remuneration if a user interacts with the advertising material and subsequently concludes an individual order of the user on copecart.com.
The amount of remuneration is based on the information provided by us in the context of advertising the possibility of participating in an advertising campaign. Unless otherwise stated, the claim to remuneration only arises when we have been fully remunerated by the end customer from the conclusion of the contract brokered by the Affiliate and have not had to refund the purchase price. A claim does not exist if the Affiliate and Vendor are identical in each case and the Affiliate thus purchases its own product or if the Affiliate purchases a product via its own affiliate link.
The basis for determining the remuneration to which the Affiliate is entitled is our accounting systems. The Affiliate is able to provide proof to the contrary.
80% of the affiliate compensation will be released for payment after the end customer's 14-day revocation period for the brokered contract has expired, and the remaining amount will be released for payment after another 40 days have passed. The payout will be made on the dates set by the affiliate on our website. Objections to our settlement must be notified to us no later than 14 days after the settlement date. After that, the payout amount is considered approved.
Payments shall only be made from an amount of 50 euros per remuneration distribution and, irrespective of the amount, upon termination of the agreement in accordance with the due date provision in paragraph 7 above.
Remunerations which have been obtained through a breach of the provisions of this Agreement, or where it subsequently transpires that the conditions for their accrual did not exist, shall be subject to recovery.

19. rights to advertising media

The advertising materials provided to the Affiliate under this Agreement and any technical protection measures associated with them may only be used in the manner in which they were provided to the Affiliate and exclusively for the purposes of this Agreement. Any other use or transfer to third parties is not permitted.
Modification or editing of the advertising materials and technical protection measures is not permitted.
For the duration of the contract or a respective advertising campaign (whichever is shorter), we grant the Affiliate only the rights to the advertising materials and the technical protection measures which are necessary for their contractual use, application and publication.
The Affiliate is not entitled to provide third parties with the advertising materials or technical protection measures and to grant rights to them.

Part III General Regulations for Vendors and Affiliates

20. communication

You must provide an email address at which we can reach you on an ongoing basis and for which incoming emails will be acknowledged within one business day and not responded to automatically. If you sign up to promote a vendor's product, the vendor (the vendor whose affiliate program you have signed up for) may send you emails to provide you with relevant information about its affiliate program and to assist you in promoting its products. You can object to receiving e-mails directly from the respective vendor at any time.

21. account blocking

We are entitled to block accounts of Vendors and Affiliates and to suspend their offers if we are of the opinion that they violate laws or the provisions of this Agreement to such an extent that it is unreasonable for us to continue activity by means of the account. We will inform the affected party of this immediately, stating the reasons.

22. liability

You undertake to assume the statutory warranty obligations arising from the contract between you and us. You shall hold us harmless from product liability claims. Warranty and liability claims of the customers based on the products sold by you through us can also be settled between you and the customers. This does not release us from our obligation.
The warranty and liability claims he indemnity claim include, in particular, expenses for the removal of defects, installation and removal costs, claims for damages, liability claims, claims and costs (including the reasonable costs of legal advice (hourly rate up to 1000 AED ) and defense as well as litigation and court costs).

23. our warranty

The choice of subsequent performance shall be incumbent upon us, subject to the statutory limits.
The limitation period for warranty claims is one year. This does not apply to liability claims, in this respect the regulations on liability apply.

24. our liability

In the event of a breach of material contractual obligations due to simple negligence, the amount of liability shall be limited to foreseeable and contract-typical damages. Material contractual obligations are those whose fulfillment makes the proper execution of the contract possible in the first place and on whose compliance the injured party may regularly rely. The limitation period for claims under this paragraph is one year.

25. Applicable law and place of jurisdiction

The contract shall be governed solely by the laws of the United Arab Emirates.
The sole place of jurisdiction for all disputes in connection with this agreement is our registered office. We shall also be entitled to assert claims against our contractual partner at one of its statutory places of jurisdiction.

26. severability clause

Should individual provisions of these General Terms and Conditions be or become invalid in whole or in part, this shall not affect the remaining provisions, unless the omission of individual clauses would put a contracting party at such an unreasonable disadvantage that it can no longer be expected to adhere to the contract.

Part IV Commissioned processing by Vendors

27. Subject of the assignment

Copecart ( for this Part IV "Client") has personal data processed on behalf by the Vendor (for this Part IV "Contractor") for the purpose of performing Cover Transactions (the respective "Main Contract"). For the execution of the Main Contract, the Principal shall commission the Contractor with a commissioned processing pursuant to the extent that the legal requirements for this are met. This commissioned processing contract shall take precedence over the main contract in the event of any contradictions.
Data of customers of the client and their customers or potential customers are affected. This includes in particular names, addresses, communication data, behavioral data, contractual data and payment data.

28. Place of commissioned processing

The commissioned processing shall take place exclusively in the United Arab Emirates
Any relocation of the commissioned processing to a third country requires the prior consent of the client.

29. Responsibility and right of instruction of the client

For the purposes of the commissioned processing, the Client is the responsible party.. He is responsible for compliance with the legal provisions on data protection, in particular for the lawfulness of the transfer of the data to the contractor as well as for the lawfulness of the data processing by the contractor.
The Client has the right at any time to issue instructions supplementing the main contract regarding the type, scope and procedure of the processing of personal data. Instructions may be given verbally or in text form. Verbal instructions of the Principal shall be confirmed by the Contractor in text form without delay. If the Principal issues instructions via copecart.com, the Principal shall document the issuance of the instructions
The Contractor shall immediately inform the Customer in text form if, in its opinion, an instruction issued by the Customer violates statutory regulations.
If the Contractor is of the opinion that it cannot follow an instruction of the Customer for technical reasons, it shall inform the Customer of this in text form and coordinate further action with the Customer.

30. Duties of the contractor

Any processing of personal data shall be carried out exclusively in accordance with the specifications of the main contract and any instructions issued by the Client. This shall also apply with regard to the transfer of personal data to a third country or an international organization. This paragraph 1 shall not apply if the Contractor is required to process by the law of the Union or the Member States to which it is subject; in such a case, the Contractor shall notify the Client of such legal requirements prior to the processing, unless the relevant law prohibits such notification due to an important public interest.
If the Contractor is required by law to appoint a company data protection officer, it shall inform the Customer of this officer and his contact details without delay. In all other respects, the Contractor shall name a contact person for the Customer for all matters relating to data protection and the implementation of this Agreement.
The Contractor shall impose a confidentiality obligation on the persons authorized to process the personal data, unless they are already subject to an appropriate statutory duty of confidentiality. The scope of the obligation shall be proportionate to the data processed and the consequences of any breach of the protection of the personal data. It shall also relate to all personal data that the Contractor processes for the Client. The content and the fact of the obligation shall be proven to the Customer upon request. Any further obligations resulting from a separate confidentiality agreement concluded between the parties shall remain unaffected.
The Contractor shall provide the Client with its Directory of Procedures for Order Processing upon request. The Contractor shall inform the Client of any subsequent changes in text form without being requested to do so.
The Contractor shall support the Client in complying with the obligations set out in Articles 32 to 36 of the GDPR, taking into account the type of processing and the information available to it. For this purpose, he shall in particular provide the services provided for in this contract.
To the extent necessary, the Contractor shall support the Client in conducting a data protection impact assessment pursuant to Art. 35 of the GDPR and shall provide the Client with all information and evidence required for this from its sphere. The Contractor shall be obligated accordingly if the Customer must conduct a prior consultation with a supervisory authority pursuant to Art. 36 of the GDPR. The Contractor shall not be entitled to any separate remuneration for the services to be provided to the Customer under this section.
At the legitimate request of the Customer, the Contractor shall provide the Customer with all necessary information to prove compliance with the obligations incumbent on the Contractor under Article 28 of the GDPR.
If the Client's data at the Contractor is endangered by attachment, seizure, by insolvency or composition proceedings or by other events or measures of third parties, or if such measures have been taken, the Contractor shall immediately inform the Client thereof in detail, unless it is not permitted to do so by law. Furthermore, the Contractor shall be obliged to inform all third parties relevant in this respect that the data is personal data for which the Client is the controller and that the Contractor itself is only acting as a processor.

31. Processing safety

The Contractor shall take all measures required pursuant to Art. 32 GDPR, in particular appropriate technical and organizational measures, to ensure a level of protection appropriate to the risk of the data processing. The Contractor shall prove compliance with these requirements to the Client by suitable means upon the Client's request
The Contractor shall be entitled to make changes to the measures in order to adapt to changed technical or legal circumstances. Changes that could affect the integrity, confidentiality or availability of the personal data, increase the risks to the rights and freedoms of the data subjects affected by the processing or generally result in a reduction of the agreed level of protection shall require the consent of the Customer. Other changes, in particular an improvement of the measures taken, may be implemented by the Contractor without the consent of the Customer. After making such changes, the Contractor shall inform the Customer without undue delay.
The Contractor shall regularly monitor its internal processes as well as the technical and organizational measures to ensure that the Processing in its area of responsibility is carried out in accordance with the requirements of this Agreement and the applicable data protection law

32. Data subject rights

The Contractor shall, insofar as it is possible and reasonable for it to do so, support the Customer with suitable technical and organizational measures in fulfilling its obligation to respond to requests to exercise the rights of the data subjects set out in Chapter 3 of the GDPR. For this purpose, the Customer shall inform the Contractor in text form which support action of the Contractor it requires and provide the Contractor with the data required to fulfill the request. Insofar as one party requires further information from the other party, it shall immediately inform the other party thereof in text form. The Contractor shall provide its support within a reasonable period of time so that the Customer can meet the deadlines incumbent upon it. The Contractor shall inform the Customer without undue delay, stating the reasons, if it does not consider itself able to provide the requested support action.
If a Data Subject should contact the Contractor directly in order to exercise the rights to which he is entitled under Chapter 3 of the GDPR, the Contractor shall refer him to the Client, insofar as it is possible for him to assign him to the Client. If it is not possible to assign the data subject to the Contractor and the Contractor is not directly obligated to the data subject as a controller under Chapter 3 of the GDPR, the Contractor shall inform the data subject that it is acting as a processor for third parties and that it cannot identify the third party with regard to the data subject. If and to the extent that the Contractor is itself obligated to the data subject as a controller under Chapter 3 of the GDPR, the Contractor alone shall be responsible for fulfilling the corresponding obligations as a controller.
The Contractor shall not be entitled to any separate remuneration for the services to be provided to the Client under this clause.

33. Control rights of the client

The Customer shall be entitled to all control rights, in particular inspections, which are necessary to comply with the obligations incumbent upon it under the provisions of the GDPR. The right of inspection shall be exercised with reasonable notice and during the Contractor's normal business hours. In order to reduce the impact of inspections on its business operations, the Contractor shall be entitled to combine them with those of other clients to the extent that this is reasonable for the Client (e.g. joint inspection dates carried out within a reasonable period of time). The Client shall ensure that inspections are only carried out to the extent necessary in order not to disproportionately disrupt the Contractor's business operations.
The Client is entitled to transfer the exercise of the control rights to a third party commissioned by the Client. If the third party is in a competitive relationship with the Contractor, the Contractor shall have the right to object to its activities
The Contractor shall cooperate in the exercise of the inspection rights to the extent required. The Contractor may make inspections by the Customer dependent on the signing of a customary and appropriate confidentiality agreement, insofar as this is necessary to protect its business secrets in accordance with the statutory requirements
The Contractor shall not be entitled to any separate remuneration for the services to be provided to the Client under this Clause.

33. Measures taken by supervisory authorities

The Contractor shall, to the extent permissible, inform the Customer without undue delay about control actions and measures of a (supervisory) authority insofar as they relate to this Agreement. This shall apply in particular insofar as an authority investigates the Contractor in the context of administrative offense or criminal proceedings with regard to the commissioned processing.
Insofar as the Customer is exposed to a control by the (supervisory) authority, administrative offense or criminal proceedings, the liability claim of a data subject or a third party or another claim in connection with the commissioned processing at the Contractor, the Contractor shall support the Customer to the extent necessary. For the services to be provided in this respect, the Contractor shall be entitled to an appropriate fee based on the time spent, unless and to the extent that the Contractor is not responsible for the corresponding control, etc. The Contractor may not make the performance of the services owed by it dependent on the Client acknowledging and/or paying a certain remuneration in advance.

34. Subprocessor

The Contractor shall not use subcontractors or change their assignment without the consent of the Customer. Consent of the Customer shall require text form. For this purpose, the Contractor shall send the following information to the Customer in text form:
- Description of the proposed change;
- Name and address of the sub-processor;
- which services the sub-processor is to provide and which personal data and which category of data subjects are affected by this;
- the content of the relevant agreements with the sub-processor and, where applicable, any evidence of compliance with Chapter 5 of the GDPR;
- the above information shall also be made available to any further sub-processors who are to provide relevant services below the sub-processor;
The Contractor shall comply with the conditions set out in paragraphs 2 and 4 of Art. 28 GDPR for any sub-processors. The Contractor shall also ensure that the contractual agreements otherwise concluded with the Customer in this respect and any supplementary instructions of the Customer are also complied with by the sub-processors. He shall provide evidence of this to the Client at the latter's request.

35. Violation of data protection regulations, agreements or instructions

The Contractor shall be obliged to notify the Client in text form of any breach of data protection regulations, of the agreements made and/or of the instructions issued without delay, at the latest 24 hours after first becoming aware of such breach. The corresponding notification shall contain at least the following information:
- A description of the nature of the breach, including, to the extent possible, the type and amount of data involved and categories of data subjects;
- The name and contact information of the data protection officer or other point of contact for further information;
- A description of the likely consequences of the personal data breach;
- A description of the measures taken or proposed by the data controller to address the personal data breach and, where appropriate, measures to mitigate its potential adverse effects.
Any notification to a supervisory authority or information of affected parties that may be required shall be the sole responsibility of the Client. The Contractor shall cooperate in this to the extent necessary.
The Contractor shall further be obligated to immediately clarify the violation to the extent required and to provide the Customer with corresponding documentation. The documentation shall include a description of the measures taken by the Contractor to prevent further violations and why the Contractor is of the opinion that the measures taken are sufficient to comply with the requirements of this Agreement and the statutory provisions.

36. Remuneration of the contractor

The Contractor shall not be entitled to any separate remuneration for the services provided by it under this Agreement, unless otherwise agreed in this Agreement

37. Liability

The Contractor shall indemnify the Customer, its bodies and employees against any claims by third parties (in particular data subjects) as well as fines or other sanctions under public law suffered by the Customer due to inadmissible or incorrect processing of personal data by the Contractor or a sub-processor in accordance with the provisions of data protection law, unless the Contractor is not responsible for the respective violation or it is based on an instruction by the Customer. The claim for indemnification shall also include all reasonable costs of legal defense and litigation of the Customer.

38. Duration of the contract

The term of this contract is based on the term of the main contract. It may only be terminated in isolation from the main contract for good cause, unless this contract or mandatory statutory provisions stipulate otherwise.

39. Consequences of the termination of the contract

Upon completion of the provision of the Processing Services, the Contractor shall either delete or return all Personal Data at the option of the Customer and delete the existing copies, unless there is an obligation to store the Personal Data under Union law or the law of the Member States to which the Contractor is subject. The Contractor shall confirm to the Customer that the deletion has been carried out in accordance with the Customer's instructions.
The Client has the right to control the complete and contractual return and deletion of the data at the Contractor.
Any right of retention of the Contractor with regard to the processed data and the associated data carriers is otherwise excluded.

Part V Order processing by copecart

40. Subject of the assignment

The Vendor (for the purposes of this Part V "Principal") shall have personal data processed by copecart (for the purposes of this Part IV "Contractor") on behalf of it on the basis of the contract for the use of copecart (the "Main Contract"). For this purpose, the Parties enter into this Commissioned Processing Agreement, which shall take precedence over the Main Agreement in the event of any inconsistency. A commissioned processing in this sense by the Contractor exists insofar as the Contractor is to process personal data by means of copecart.com for which the Contractor is the controller.
Data of the client and its customers are affected. This includes in particular names, addresses, communication data, behavioral data, contractual data and payment data

41. Responsibility and right of instruction of the client

For the purposes of the commissioned processing, the Client is the responsible party. He is responsible for compliance with the legal provisions on data protection, in particular for the lawfulness of the transfer of the data to the contractor as well as for the lawfulness of the data processing by the contractor.
The Customer shall have the right at any time to issue instructions supplementing the main contract regarding the type, scope and procedure of processing the personal data. Instructions shall be given by means of the website copecart.com, as far as possible, otherwise in text form. Instructions that are not covered by the contract on the use of copecart.com are subject to a charge, insofar as a fee is customary for this.
The Contractor shall immediately inform the Customer in text form if, in its opinion, an instruction issued by the Customer violates statutory regulations. As long as the parties have not resolved the Contractor's concerns, the Contractor shall be entitled to suspend the implementation of the relevant instruction. If the parties are unable to reach an agreement and the Customer adheres to its instruction, the Contractor shall be entitled to terminate this Agreement with reasonable notice, which shall not be less than two weeks. If in this case the main contract cannot be executed, the Client shall be entitled to terminate this contract if the main contract could only be executed by implementing the unlawful instruction and this was not apparent to either party at the time the contract was concluded.
If the Contractor is of the opinion that it cannot follow an instruction of the Customer for technical reasons, it shall inform the Customer of this in text form and coordinate further action with the Customer.

42. Duties of the contractor

Any processing of personal data shall be carried out exclusively in accordance with the specifications of the main contract and any instructions issued by the Client. This shall also apply with regard to the transfer of personal data to a third country or an international organization. This paragraph 1 shall not apply if the Contractor is required to process by the law of the Union or the Member States to which it is subject; in such a case, the Contractor shall notify the Client of such legal requirements prior to the processing, unless the relevant law prohibits such notification due to an important public interest.
The Contractor confirms that it is not required by law to appoint an in-house data protection officer. He shall appoint a contact person for the Customer in his place for all matters relating to data protection and the implementation of this Agreement.
The Contractor shall impose a confidentiality obligation on the persons authorized to process the personal data, unless they are already subject to an appropriate statutory duty of confidentiality. The scope of the obligation shall be proportionate to the data processed and the consequences of any breach of the protection of the personal data. It shall also relate to all personal data that the Contractor processes for the Client. The content and the fact of the obligation shall be proven to the Customer upon request. Any further obligations resulting from a separate confidentiality agreement concluded between the parties shall remain unaffected.
The Contractor shall provide the Client with its Directory of Procedures for Order Processing upon request. The Contractor shall inform the Client of any subsequent changes in text form without being requested to do so.
The Contractor shall support the Client in complying with the obligations set out in Articles 32 to 36 of the GDPR, taking into account the type of processing and the information available to it. For this purpose, he shall in particular provide the services provided for in this contract.
To the extent necessary, the Contractor shall support the Client in conducting a data protection impact assessment pursuant to Art. 35 of the GDPR and shall provide the Client with all information and evidence required for this from its sphere. He shall be obligated accordingly if the Principal has to conduct a prior consultation with a supervisory authority pursuant to Art. 36 of the GDPR. For the services to be provided under this paragraph, the Contractor shall be entitled to an appropriate fee based on the time spent. The Contractor may not make the provision of the services owed by it dependent on the Client acknowledging and/or paying a certain remuneration in advance.
At the legitimate request of the Customer, the Contractor shall provide the Customer with all necessary information to prove compliance with the obligations incumbent on the Contractor under Article 28 of the GDPR.
If the Client's data at the Contractor is endangered by attachment, seizure, by insolvency or composition proceedings or by other events or measures of third parties, or if such measures have been taken, the Contractor shall immediately inform the Client thereof in full, unless it is not permitted to do so by law. Furthermore, the Contractor shall be obliged to inform all third parties relevant in this respect that the data is personal data for which the Client is the controller and that the Contractor itself is only acting as a processor.

43. Obligations of the client

The Customer shall inform the Contractor without undue delay, stating the reasons, if it discovers errors or irregularities in the results of the order or with regard to the Contractor's activities with regard to the requirements of this Agreement or the GDPR.

44. Processing safety

The Contractor shall take all measures required pursuant to Art. 32 GDPR, in particular appropriate technical and organizational measures, to ensure a level of protection appropriate to the risk of the data processing. The Contractor shall prove compliance with these requirements to the Client by suitable means upon the Client's request.
The Contractor is entitled to adapt to changed technical or legal circumstances. The Contractor shall inform the Client without delay of any changes that may mean a reduction in the level of protection.

45. Data subject rights

The Contractor shall, insofar as it is possible and reasonable for it to do so, support the Customer with suitable technical and organizational measures in fulfilling its obligation to respond to requests to exercise the rights of the data subjects set out in Chapter 3 of the GDPR. For this purpose, the Customer shall inform the Contractor in text form which support action of the Contractor it requires and provide the Contractor with the data required to fulfill the request. Insofar as one party requires further information from the other party, it shall immediately inform the other party thereof in text form. The Contractor shall provide its support within a reasonable period of time so that the Customer can meet the deadlines incumbent upon it. The Contractor shall inform the Customer without undue delay, stating the reasons, if it considers itself unable to perform the requested support action.
If a Data Subject should contact the Contractor directly in order to exercise the rights to which he is entitled under Chapter 3 of the GDPR, the Contractor shall refer him to the Client, insofar as it is possible for him to assign him to the Client. If it is not possible to assign the data subject to the Contractor and the Contractor is not directly obligated to the data subject as a controller under Chapter 3 of the GDPR, the Contractor shall inform the data subject that it is acting as a processor for third parties and that it cannot identify the third party with regard to the data subject. If and to the extent that the Contractor is itself obligated to the data subject as a controller under Chapter 3 of the GDPR, the Contractor alone shall be responsible for fulfilling the corresponding obligations as a controller.
The Contractor shall be entitled to a reasonable fee for the services to be rendered to the Customer under this clause, based on the time spent. The Contractor may not make the performance of the services owed by it dependent on the Client acknowledging and/or paying a certain remuneration in advance.

46. Control rights of the client

The Customer shall be entitled to all control rights, in particular inspections, which are necessary to comply with the obligations incumbent upon it under the provisions of the GDPR. The right of inspection shall be exercised with reasonable notice and during the Contractor's normal business hours. In order to reduce the impact of inspections on its business operations, the Contractor shall be entitled to combine them with those of other clients to the extent that this is reasonable for the Client (e.g. joint inspection dates carried out within a reasonable period of time). The Client shall ensure that inspections are only carried out to the extent necessary in order not to disproportionately disrupt the Contractor's business operations.
The Client is entitled to transfer the exercise of the control rights to a third party commissioned by the Client. If the third party is in a competitive relationship with the Contractor, the Contractor shall have the right to object to its activities.
The Contractor shall cooperate in the exercise of the inspection rights to the extent required. The Contractor may make inspections by the Customer dependent on the signing of a customary and appropriate confidentiality agreement, insofar as this is necessary to protect its business secrets in accordance with the statutory requirements.
For the services to be rendered under this section, the Contractor shall be entitled to an appropriate fee based on the time spent , unless the Contractor is responsible for the inspection or it is an inspection carried out or ordered by a supervisory authority. The Contractor may not make the performance of the services owed by it dependent on the Client acknowledging and/or paying a certain remuneration in advance.

47. Measures taken by supervisory authorities

The Contractor shall, to the extent permissible, inform the Customer without undue delay about control actions and measures of a (supervisory) authority insofar as they relate to this Agreement. This shall apply in particular insofar as an authority investigates the Contractor in the context of administrative offense or criminal proceedings with regard to the commissioned processing.
Insofar as the Customer is exposed to a control by the (supervisory) authority, administrative offense or criminal proceedings, the liability claim of a data subject or a third party or another claim in connection with the commissioned processing at the Contractor, the Contractor shall support the Customer to the extent necessary. For the services to be rendered in this respect, the Contractor shall be entitled to an appropriate fee based on the time spent, unless and to the extent that the Contractor is not responsible for the corresponding control, etc. The Contractor may not make the performance of the services owed by it dependent on the Client acknowledging and/or paying a certain remuneration in advance.

48. Subprocessor

The Contractor shall use sub-processors for the processing, which shall be notified to the Client.
The Contractor shall inform the Customer in text form of any changes to the commissioning of subcontracted processors. The Customer may object to the change within a period of two weeks from receipt of the information. The Contractor shall not implement the change before the expiry of the objection period. In the event of an objection, the Contractor shall be entitled to terminate the Order Processing Agreement with a notice period of at least one month, provided that the change would have been reasonable for the Customer and the objection is unreasonable for the Contractor. Reasonableness for the Customer is given if no disadvantages for the Customer would have had to be feared with the change and, in particular, it would have been ensured that the requirements of this Agreement and the GDPR would have continued to be complied with upon implementation of the change. Unreasonableness for the Contractor is given if it provides its contract processing services as an essentially uniform process for a large number of clients and individual deviations in the subcontracted processors are not easy to implement for the Contractor (e.g. all clients use the same, standardized software platform).
The Contractor shall comply with the conditions set out in paragraphs 2 and 4 of Art. 28 GDPR for any sub-processors. The Contractor shall also ensure that the contractual agreements otherwise concluded with the Customer in this respect as well as any supplementary instructions of the Customer are also complied with by the sub-processors. He shall provide evidence of this to the Client at the latter's request.

49. Violation of data protection regulations, agreements or instructions

The Contractor shall be obliged to notify the Client in text form of any breach of data protection regulations, of the agreements made and/or of the instructions issued without delay, at the latest 24 hours after first becoming aware of such breach. The corresponding notification shall contain at least the following information:
- A description of the nature of the breach, including, to the extent possible, the type and amount of data involved and categories of data subjects;
- The name and contact details of the data protection officer or other point of contact for further information;
- A description of the likely consequences of the personal data breach;
- A description of the measures taken or proposed by the data controller to address the personal data breach and, where appropriate, measures to mitigate its potential adverse effects.
Any notification to a supervisory authority or information of affected parties that may be required shall be the sole responsibility of the Client. The Contractor shall cooperate in this to the extent necessary.
The Contractor shall further be obligated to immediately clarify the violation to the extent required and to provide the Customer with corresponding documentation. The documentation shall include a description of the measures taken by the Contractor to prevent further violations and why the Contractor is of the opinion that the measures taken are sufficient to comply with the requirements of this Agreement and the statutory provisions.

50. Remuneration of the contractor

The Contractor shall not be entitled to any separate remuneration for the services provided by it under this Agreement, unless otherwise agreed in this Agreement.

51. Liability

The liability of the parties shall be governed by the agreements of the main contract. The direct liability of the parties vis-à-vis a data subject arising from statutory provisions on data protection shall remain unaffected.

52. Duration of the contract

53. Consequences of the termination of the contract

Upon completion of the provision of the Processing Services, the Contractor shall either delete or return all Personal Data at the option of the Customer and delete the existing copies, unless there is an obligation to store the Personal Data under Union law or the law of the Member States to which the Contractor is subject. The Contractor shall confirm to the Customer that the deletion has been carried out in accordance with the Customer's instructions.
The Client has the right to control the complete and contractual return and deletion of the data at the Contractor.
Any right of retention of the Contractor with regard to the processed data and the associated data carriers is otherwise excluded.