General terms and conditions

The platform nisd2.eu ("Platform") is provided by Kardashev Catalyst UG (haftungsbeschränkt), Trierer Str. 6, 50676 Köln, Germany, represented by its managing director Simon Orzel, registered at Amtsgericht Köln under HRB 126993, VAT ID DE462889433 ("Provider").

These terms apply to the use of the Platform the Provider operates at nisd2.eu, free and with an annual licence. Part A applies to every use, Part B also to the paid annual licence.

Anyone who runs the software themselves uses it under the open source licence AGPL 3.0. These terms do not apply to that.

The customer's own general terms apply only if the Provider expressly agrees to them in text form.

The Platform is software with which organisations organise their duties under NIS 2 and the German BSIG. It offers structured workflows, forms, document management and tracking of open points.

The Platform supports the customer in areas that are the customer's sole responsibility. The Provider does not owe any particular outcome of the implementation.

The Platform is not legal advice, not an examination of a specific matter of another person within the meaning of § 2 RDG, and not any other legal service. Its content (requirement descriptions, guidance text, form fields, information pages) is general legal information based on public sources: Directive (EU) 2022/2555 (NIS 2), the BSIG, BSI publications and ENISA guidance.

The Platform does not replace legal or professional advice on an individual case. For advice on their situation, users should consult professionals.

No client relationship and no advisory relationship arises between the Provider and users.

The customer is solely responsible for the accuracy and completeness of its input, for determining which requirements apply to it, for its decisions, and for complying with NIS 2, the BSIG and every other rule that applies to it. Where appropriate, it has its documentation reviewed by professionals.

The duties under NIS 2 fall on the entity and its management. In Germany, the management bodies of essential and important entities must implement the cybersecurity risk management measures the entity has to take under § 30 BSIG and oversee their implementation (§ 38(1) BSIG). This responsibility stays with the customer and its management. The Provider does not take over any of these duties by providing the Platform.

The Platform checks whether forms are complete. It does not check whether the content is correct or legally sufficient.

The Provider does not promise that using the Platform leads to passing audits, inspections or regulatory reviews, that it prevents action by supervisory authorities, or that it covers every requirement that applies to a particular organisation. The Platform's results rest on the customer's input.

The Platform has the properties described in A2 and, for the annual licence, in B1. The Provider gives a guarantee in the legal sense only if it expressly calls it a guarantee in text form.

The Provider operates the Platform with due care and fixes faults within a reasonable time. No particular availability rate is agreed. The Provider announces maintenance in advance where possible.

The Provider is liable for outages under A7.

(1) The Provider is liable without limitation for intent and gross negligence, for injury to life, body or health, under the German Product Liability Act, and where it has given a guarantee.

(2) For slight negligence, the Provider is liable only if it breaches an essential contractual duty. Essential duties are those whose fulfilment makes the proper performance of the contract possible in the first place and on whose fulfilment the customer may regularly rely; for the annual licence this includes providing the Platform. Liability is then limited to the typical damage foreseeable when the contract was made.

(3) In the cases of paragraph 2, liability is also limited in total to the fees the customer paid the Provider in the twelve months before the event that caused the damage.

(4) Otherwise, liability for slight negligence is excluded.

(5) Liability under Art. 82 GDPR is not affected. The limitations also apply in favour of the Provider's employees and agents.

(6) The Provider does not take over the customer's duties under NIS 2 and the BSIG (A4). The customer, not the Provider, is therefore liable for fulfilling them.

The customer indemnifies the Provider against third-party claims, damage and costs that arise because the customer uses the Platform in breach of these terms, because it enters inaccurate, incomplete or misleading data, or that concern its own state of implementation or its regulatory duties.

The Platform's content, including software, requirement structures, form designs, guidance text and workflows, is the Provider's intellectual property. The rights granted by the software's open source licence are not affected.

All data the customer enters remains the customer's data. The Provider processes personal data in it only as a processor under the data processing agreement (Annex 1).

Where the Provider processes personal data on the customer's behalf when the Platform is used, the data processing agreement applies as Annex 1 to these terms. It consists of the European Commission's standard contractual clauses under Implementing Decision (EU) 2021/915 and the Provider's annexes. In case of conflict, the standard contractual clauses prevail.

How the Provider processes data for which it is itself responsible, such as the user account and billing data, is set out in the privacy policy.

Annex 1: data processing agreement

The Provider may change these terms and the data processing agreement if the Platform, the law or case law changes. It announces every change in text form at least six weeks before it takes effect, names the changed passages, and points out the right to object and the consequence of silence.

The customer may object until the change takes effect. If it objects, either side may terminate the annual licence as of the day the change takes effect; the Provider refunds fees paid in advance for the time after that pro rata. If the customer does not object, the changes apply from the announced day.

The Provider does not change the price of a licence year that is running.

The subject is the right to use the hosted Platform with the NIS 2 walkthrough for one licence year ("annual licence"). The Provider makes the Platform available over the internet. The customer does not receive a copy of the software.

The annual licence covers the customer's account: every organisation and every user on that account. One payment covers all of them.

Organisations in this sense are the customer itself and the companies of its own group: companies affiliated with it or majority-owned by the same shareholders. If the customer uses the Platform for organisations it looks after as a service provider, for example as an IT service provider, managed service provider, consultant or external information security officer, each of those organisations needs its own annual licence unless agreed otherwise.

The annual licence is offered only to businesses (Unternehmer within the meaning of § 14 BGB), meaning persons and companies that act in the course of their trade, business or profession when they order. A VAT number is required to order.

Whoever orders declares that they act for the company named and are authorised to do so.

Order on the Platform: the customer enters the billing details, sees the price including VAT, confirms these terms with the data processing agreement and clicks "Place order". This is a binding offer. The Provider accepts it by opening the annual licence at once and sending the invoice by email. The customer can correct input errors in the fields until the click.

Order on a call: if the customer and the Provider agree the annual licence on a call, the contract is made on that call. The Provider confirms it with the invoice and access to the Platform.

For every order, the Provider stores which version of these terms and the data processing agreement was accepted, when and by whom. The customer sees this under Billing. It can save or print the text on this page before ordering.

The annual licence costs 4,800 euros net per licence year plus VAT where it applies.

Anyone who used the Platform before prices were introduced and is therefore recorded as an existing user pays 2,400 euros net per licence year, including every renewal. What counts is whether the person who holds the account is an existing user.

VAT follows the VAT number: customers in Germany pay German VAT. For customers in another EU member state whose VAT number is confirmed in the EU register, the customer owes the tax (reverse charge). The customer sees the amount including tax before the click.

If a different price was agreed on a call, that price applies. The invoice states it.

The invoice is issued on the day of the order. It is payable by bank transfer within 30 days of the invoice date, quoting the invoice number as the reference. Access starts with the order, not with the payment.

The customer agrees to receive invoices and credit notes as PDF by email (§ 14(1) and § 27(38) UStG). Invoices go to the address it gives for them when ordering.

The first licence year starts on the day of the order and ends on the day before the same calendar day of the following year.

The annual licence renews for one further licence year at a time unless the customer cancels by the last day of the running licence year. It can cancel under Billing with the button, or in text form by email to contact@nisd2.eu.

The Provider issues the invoice for a new licence year when that year starts. 14 days before, it reminds the customer by email of the renewal, the price and how to cancel. The licence renews at the previous price; for existing users it stays at 2,400 euros net. B5 applies to every renewal.

On the first order for their account, the customer can cancel the annual licence within 30 days after the day of the order without giving a reason. The day of the order does not count; the thirtieth day after it does. Calendar days in Germany apply.

This does not apply to renewals, nor to any later order for the same account, including a new order after a cancellation. B8 applies to those from the first day.

The customer cancels under Billing with the button, or in text form by email to contact@nisd2.eu.

The Provider then cancels the invoice in full with a credit note. If it was still open, the customer owes nothing more. If the customer had already paid, the Provider transfers the full amount back within 30 days of the cancellation to the account the payment came from. A payment that arrives only after the cancellation is refunded within 30 days of its arrival.

The annual licence ends at once. The account falls back to use without a licence; for existing users, to the continued free use of the current walkthrough. The customer's data stays stored (B10).

After the thirty days, and from the start for renewals and later orders, cancelling ends the renewal. The annual licence runs until the end of the paid licence year. The invoice for that year remains due; there is no pro rata refund.

The right to terminate for good cause is not affected.

If the invoice is not paid by the end of the due date, which is 30 days after the invoice date, the Provider suspends access to the annual licence without a further period. The account then falls back to use without a licence as in B7. The data stays stored.

The invoice remains due. When the payment arrives, the Provider reopens the annual licence for the rest of the licence year.

The statutory rights in case of late payment are not affected.

When the annual licence ends, by cancellation, by expiry without renewal, or by suspension under B9, the account remains and falls back to use without a licence. The Provider does not delete any data when this happens.

Without a licence, the account reaches only Billing, Settings, Organisation, Notifications and Export, so the exports of its own data stay reachable at all times. The other content is reachable again only with a new order. Existing users keep the free use of the current walkthrough.

On the customer's instruction, the Provider returns or deletes the data as the data processing agreement provides. An email to contact@nisd2.eu is enough.

The law of the Federal Republic of Germany applies, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG).

If the customer is a merchant (Kaufmann), a legal person under public law or a special fund under public law, Köln is the exclusive place of jurisdiction for all disputes arising from this contract.

These terms exist in German and in English. The contract language is the language in which the customer orders. If the versions differ, the German version prevails.

If a provision of these terms is invalid or unenforceable, the others remain valid. The statutory rule takes the place of the invalid provision.

Questions about these terms: Kardashev Catalyst UG (haftungsbeschränkt), Trierer Str. 6, 50676 Köln, Germany, contact@nisd2.eu.