General Terms and Conditions

1. Scope and conclusion of contract

1.1 These General Terms and Conditions (“Terms”) apply to all contracts between CONCEPTS Gabriela Prett-Preza KG, Illekgasse 8/16, 1150 Vienna, Austria, FN 462437f (“Contractor”), and its customers (“Client”) concerning the Necesso platform and related services. They also apply to future services, even if not referred to again.

1.2 These Terms apply exclusively to businesses within the meaning of Sec. 1 of the Austrian Consumer Protection Act (KSchG). No contracts are concluded with consumers.

1.3 The Client’s general terms and conditions do not apply, even if the Contractor does not expressly object to them.

1.4 The Contractor’s offers are non-binding. A contract is concluded by the Contractor’s written order confirmation, by completion of the online ordering process or by commencement of performance. The content of the offer or order confirmation is decisive.

2. Definitions

• Platform: the Necesso software, provided by the Contractor as an online service (software as a service) via web and mobile apps.
• Users: natural persons authorised by the Client to use the Platform.
• Client Data: all data that the Client or its Users enter into the Platform or that is generated there for the Client, including data of its contacts.
• Individual Services: services tailored to the Client, such as design, customisation, programming, setup, training and consulting.

3. Services

3.1 The Contractor provides the Client with the Platform in the scope of the selected package for the term of the contract. The scope of services is set out in the offer and the current service description.

3.2 The Platform includes in particular: management of enquiries, jobs and contacts, AI assistants (clause 7), WhatsApp integration, call recording and transcription (clause 8) and bank connection (clause 9), to the extent included in the package.

3.3 The Contractor continuously develops the Platform and may change it, provided that the agreed scope of services is not materially reduced. It announces material changes at least 30 days in advance.

3.4 Individual Services are only provided if separately agreed. Clause 11 applies.

3.5 Accessible design within the meaning of the Austrian BGStG, WZG or BaFG is only owed if expressly agreed.

3.6 The Contractor may use third parties (subcontractors and sub-processors) to provide its services. The data processing agreement (clause 6) applies to sub-processors.

Optional integrations: A live bank connection through Enable Banking and calls/SMS through Twilio apply only after separate activation. Bank reconciliation using an imported statement file is separate. Payment providers (Stripe/Adyen) and accounting or wholesaler interfaces are not described as active without confirmation.

4. Availability, maintenance and support

4.1 The Contractor endeavours to keep the Platform available with as few interruptions as possible. A specific level of availability is only owed if expressly agreed in the offer or in a service level agreement (SLA).

4.2 The Contractor carries out maintenance outside normal business hours where possible and announces planned interruptions in good time.

4.3 The Contractor is not responsible for disruptions of the Client’s internet connection, of telecommunications networks or of third-party services, in particular Meta (WhatsApp), banks and account information services.

4.4 Support is provided by e-mail to office@necesso.ai during the Contractor’s business hours. The Contractor responds within a reasonable time. Further response times only apply if agreed.

5. Client obligations

5.1 The Client keeps login credentials secret, protects them against unauthorised access and informs the Contractor immediately if misuse is suspected.

5.2 The Client is responsible for Client Data and its lawfulness. It does not store content that violates laws, official orders or third-party rights, and checks uploaded files for malware using state-of-the-art measures.

5.3 The Client informs its contacts about the processing of their data in the Platform, to the extent it is obliged to do so as controller.

5.4 The Client cooperates in the provision of services, provides necessary information in full and in good time, and names a contact person. Delays and additional costs resulting from a lack of cooperation are borne by the Client.

5.5 The Client uses the Platform only for its own business purposes. It may not make the Platform available to third parties, use it to send unsolicited advertising or attempt to circumvent security mechanisms.

6. Data protection and data processing on behalf

6.1 Where the Contractor processes personal data on behalf of the Client, it acts as a processor within the meaning of Art. 28 GDPR. The parties conclude a data processing agreement (DPA), which forms an integral part of this contract. The current list of sub-processors is set out in the DPA.

6.2 For data for which the Contractor itself is the controller, its privacy policy at necesso.ai/en/datenschutz applies.

6.3 Data location: Platform data is stored on servers of Hetzner Online GmbH in Germany. Nightly backups remain for 14 days on the server; historical copies in a separate Hetzner Storage Box and at Scaleway in Paris are currently kept without an expiry date. Under the technical documentation, Necesso itself encrypts the backup copies using AES-256 before they leave its server, with encryption keys held separately. Client businesses are logically segregated. Operator-managed full-disk encryption of primary servers and a defined retention limit for historic offsite backups are not documented. AI processing is governed by clause 7 and the privacy policy.

6.4 Transfers outside the EEA: For transfers to Anthropic outside the EEA, Client Data is pseudonymised using placeholders before transmission. Per-request placeholder mappings remain in the EU server’s memory while a request runs. Transfers are subject to the applicable mechanisms under Art. 44 et seq. GDPR and the relevant provider agreements. When calling or SMS features through Twilio are activated, data may also be processed in the USA under Twilio’s contractual conditions and Standard Contractual Clauses. Meta’s conditions apply to the WhatsApp integration. Mistral processes certain personal data via its EU API endpoint.

6.5 The technical and organisational measures are described in the “Data security” document and form part of the DPA.

6.6 The Contractor obliges its employees to maintain data secrecy under Sec. 6 of the Austrian Data Protection Act (DSG).

7. AI features

7.1 The Platform uses Mistral as a main AI model, including with personal data through its EU API endpoint. Anthropic receives pseudonymised content after recognised direct identifiers have been replaced with placeholders. Data are hosted at Hetzner in Germany, and other EU service providers may receive personal data for the purposes described in the privacy policy. Transfers to Anthropic are subject to the applicable safeguards under Art. 44 et seq. GDPR and provider agreements. Optional Twilio services may involve processing in the USA after activation; see clause 6.4. Pseudonymisation is not anonymisation.

7.2 Results of these features, such as summaries, draft replies, quotes and payment matches, are suggestions. The Client reviews them before use. The Contractor does not warrant their accuracy or completeness. Decisions with legal effect are always made by a person.

7.3 Processing follows the privacy policy and DPA; transfers outside the EEA are permitted only under the conditions in clause 6.4. AI providers may not use Client Data to train their models. Pseudonymisation is not complete anonymisation.

Technical clarification (29 October 2026): The assistant is currently configured to use Mistral’s EU endpoint; provider selection is a server-side setting. Requests from EU businesses to Anthropic use the privacy gateway, which minimises data and inserts request-specific placeholders. Failed or identified incomplete checks prevent transmission, but unrecognised personal details may still pass through. Transfers require a genuinely applicable transfer mechanism under Art. 44 et seq. GDPR. These technical details supplement the privacy policy and the applicable DPA.

8. Call recording, transcription and messaging

8.1 When telephony is activated, the documented technical workflow currently plays a recording/transcription announcement at the start of a call and then records it. The announcement is not a consent-confirmation mechanism. The Client must ensure that recording and transcription are lawful and that any legally required consent is obtained before using the function. The parties must check the activation workflow and lawful basis prior to launch.

8.2 Telephone calls and WhatsApp voice notes are transcribed using Whisper on our own Hetzner servers. Dictation in German, English, Hungarian and Turkish is sent to Voxtral through Mistral’s EU endpoint. Dictation in Romanian and other languages, or if Mistral is unavailable, is processed by Whisper at Hetzner. After transcription the text is sent to Mistral EU for AI correction. Text-to-speech output uses Piper on Hetzner servers.

8.3 The WhatsApp integration runs directly via Meta’s WhatsApp Business Platform. The Client complies with Meta’s terms and applicable telecommunications law.

8.4 Job audio and WhatsApp voice notes are deleted from active storage seven days after a transcript exists; call recordings 14 days after a transcript exists. If transcription fails, the automated deadline may not start. Transcripts are retained with the related business records, subject to agreed and statutory retention requirements; a general 90-day automatic deletion period is not represented by the supplied technical documentation. Deleted audio may remain in historic backups under the separate retention arrangements described in the Privacy Policy and security measures.

9. Bank connection

9.1 Bank transactions may be reconciled by importing account statements (CSV or file). A live bank connection via Enable Banking (Finland) applies only after separate activation and requires the Client’s express consent.

9.2 Online banking credentials are only transmitted to the bank or the account information service and are not stored by the Contractor.

9.3 The Contractor is not liable for the unavailability or changes of bank interfaces or account information services.

10. Rights of use

10.1 For the term of the contract, the Client receives a non-exclusive, non-transferable and non-sublicensable right to use the Platform within the scope of the purchased user licences for its own business purposes.

10.2 All rights to the Platform, the documentation and work results remain with the Contractor or its licensors, unless otherwise agreed. The Client’s cooperation does not establish co-authorship.

10.3 For Individual Services, the Client receives, after full payment, a non-exclusive, perpetual right of use for its own internal purposes. Exclusive rights and handover of source code require a separate agreement.

10.4 The licence terms of third-party software take precedence. The Client’s rights under Sec. 40d and 40e of the Austrian Copyright Act (UrhG) remain unaffected.

10.5 Client Data remains the property of the Client. The Contractor uses it only to perform the contract.

11. Individual Services and acceptance

11.1 Individual Services are based on a written service description, which the Client checks for accuracy and completeness and approves. Later change requests may lead to new agreements on deadlines and prices.

11.2 The Client accepts Individual Services within four weeks of delivery and confirms this in writing. If it lets this period expire without reporting material defects, or uses the service in live operation, the service is deemed accepted. Acceptance may not be refused because of minor defects.

11.3 If it becomes apparent that the service cannot be performed as described for factual or legal reasons, the Contractor informs the Client without delay. If the Client does not amend the service description accordingly, the Contractor may withdraw from the contract; services provided until then are to be paid.

11.4 The Client may only cancel Individual Services with the Contractor’s consent. In addition to services already provided, the Contractor may charge a cancellation fee of 30% of the order value not yet invoiced.

12. Prices and payment

12.1 All prices are in euros plus VAT.

12.2 Subscription fees are invoiced in advance for the agreed billing period. Individual Services are charged by time and effort at the rates valid on the day of performance, unless a fixed price has been agreed. Travel time counts as working time; travel and accommodation costs are charged separately.

12.3 Invoices are payable within 14 days of receipt without deduction. In the event of late payment, statutory default interest for business transactions applies. After a reminder, the Contractor may block access to the Platform until outstanding amounts are paid; Client Data is preserved during the block.

12.4 The Client may only set off undisputed or legally established claims. A right of retention due to warranty claims is excluded.

12.5 Recurring fees are index-linked to the collective agreement salary for employees in the field of services in automatic data processing and information technology, experience level special activities (ST2). If this salary changes, the Contractor may adjust the fees in the same proportion; it announces this at least one month in advance.

13. Warranty

13.1 The Contractor warrants that the Platform substantially conforms to the service description during the term of the contract. For Individual Services, the warranty period is six months from acceptance.

13.2 Defects must be reported without delay, at the latest within the period under Sec. 377 of the Austrian Commercial Code (UGB), in writing or by e-mail with a comprehensible description. The Contractor remedies reported defects within a reasonable period; repair takes precedence over price reduction or termination.

13.3 The presumption of defectiveness under Sec. 924 ABGB and the defence under Sec. 933(3) ABGB are excluded. Warranty claims expire in any case one month after the end of the warranty period.

13.4 There is no warranty for defects resulting from changes by the Client or third parties, improper use, third-party services or a lack of cooperation by the Client.

13.5 The update obligation under Sec. 7 of the Austrian Consumer Warranty Act (VGG) is excluded unless otherwise agreed. The Contractor provides updates to the Platform as part of its ongoing development.

14. Liability

14.1 The Contractor is only liable for damage caused intentionally or through gross negligence. This also applies to its vicarious agents. Liability for personal injury is unlimited.

14.2 Liability for loss of profit, consequential damage, business interruption and third-party claims is excluded, except in cases of intent.

14.3 For data loss, the Contractor is only liable for the cost of restoring data from existing backups, up to a maximum of 10% of the annual fee per damage event and no more than EUR 15,000.

14.4 Claims for damages become time-barred in accordance with statutory provisions, but no later than one year after the damage and the party causing it become known.

14.5 If the Contractor uses third parties and warranty or liability claims arise against them, it assigns these claims to the Client upon request.

15. Term and termination

15.1 Subscriptions run for the minimum term agreed in the offer and are then extended for an indefinite period. If nothing has been agreed, either party may terminate in writing with six months’ notice, at the earliest at the end of the minimum term.

15.2 Either party may terminate without notice for good cause, in particular if the other party breaches material obligations despite a written warning or if performance is prevented by force majeure for more than six months.

15.3 After the end of the contract, the Client may export its data in a common format within 30 days. Active Client Data is deleted according to the DPA and statutory retention obligations. Backups are subject to separate periods: nightly backups are kept 14 days on the server, while copies in the Hetzner Storage Box and at Scaleway in Paris have no set expiry. Deleting the client-specific key is not represented as a guarantee that all backups will become unreadable.

16. Confidentiality

16.1 Each party treats the other party’s trade secrets as confidential and does not disclose them to third parties. This does not apply to information that is generally known, was already known to the recipient without an obligation of confidentiality, was disclosed to it by a third party without an obligation of confidentiality, was demonstrably developed independently by it, or must be disclosed on the basis of an official or court decision.

16.2 The Contractor’s subcontractors are not considered third parties if they are subject to an equivalent confidentiality obligation.

17. Non-solicitation

During the term of the contract and for twelve months thereafter, neither party will solicit employees of the other party who were involved in performing the contract, including through third parties. For each breach, a contractual penalty of twelve times the last gross monthly salary of the employee concerned is payable.

18. Force majeure

Events beyond a party’s control, such as war, terrorism, natural disasters, fire, strikes, embargoes, official intervention, failure of power supply, telecommunications networks or third-party services, release that party from its obligation to perform for their duration and do not constitute a breach of contract.

19. Final provisions

19.1 Amendments and additions to the contract must be made in writing; e-mail is sufficient. This also applies to any waiver of this form requirement.

19.2 The transfer of rights and obligations under the contract requires the prior written consent of the other party. The Contractor may transfer the contract to an affiliated company without consent.

19.3 If a provision is invalid, the remainder of the contract remains valid. It is replaced by a valid provision that comes closest to its economic purpose.

19.4 In the event of disputes, the parties first seek an amicable solution, at the request of either party through registered business mediators (ZivMediatG). Legal action is initiated no earlier than one month after negotiations have failed; measures to secure claims remain possible.

19.5 Austrian law applies, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction is the court with subject-matter jurisdiction for the Contractor’s registered office in Vienna.

19.6 In case of discrepancies between the German and English versions, the German version prevails.

As of: October 2026