1. These General Terms and Conditions (hereinafter "GTC") of Secure 2 Fiber GmbH, Am Brambusch 24, 44536 Lünen, Germany (hereinafter "Seller" or "Manufacturer"), apply to all contracts for the delivery of goods and the provision of services concluded by a customer with the Seller via the online shop at secure2fiber.com, via the customer portal, or by any other means (in particular by e-mail or written offer).

2. Secure 2 Fiber GmbH is a developer and manufacturer of network and security appliances and associated software. Products are developed and sold under proprietary brands. In connection with its hardware business, the Seller also sources components from third-party manufacturers (OEM hardware), qualifies them, loads them with proprietary firmware and software, and markets them under the Seller's own brands as complete appliances (hereinafter "OEM-based products"). In all cases, the Seller acts as manufacturer and person placing the product on the market vis-à-vis the customer.

3. For the purposes of these GTC, the following definitions apply:

• Business Customer (Unternehmer) means a natural or legal person or a partnership with legal capacity that, when concluding the contract, acts in the exercise of its commercial or independent professional activity (§ 14 BGB).
• Consumer (Verbraucher) means any natural person who concludes a legal transaction for purposes that are predominantly neither commercial nor self-employed professional in nature (§ 13 BGB).
• Customer means both business customers and consumers.
• Client (Auftraggeber) means the customer in the context of service and maintenance contracts.
• Contractor (Auftragnehmer) means the Seller in the context of service and maintenance contracts.
• Products means all goods and services offered by the Seller under the brands AIMSTRONG, AIMdefense, AIMdesk, AIMcompute, AIMroute and AIMnetworks (collectively "AIM Product Family").
• OEM Hardware means hardware components (boards, chassis, power supplies, network cards, etc.) that the Seller sources from qualified third-party manufacturers, loads with proprietary firmware and software, and places on the market as AIMSTRONG appliances.
• Third-Party Software means open-source or proprietary software from third-party providers (in particular OPNsense, Zenarmor, and other integrated security modules) included in AIMdefense products, which is subject to the respective licence terms of each provider.

4. Deviating, conflicting or supplementary terms and conditions of the customer shall only become part of the contract if the Seller has expressly agreed to their applicability in writing.

5. Part A applies to all customers. Part B applies exclusively to business customers. Part C applies exclusively to consumers and takes precedence over conflicting provisions in Part A.

These GTC govern the business relationship between Secure 2 Fiber GmbH and its customers. They apply to the following services:

Supply of Hardware, Software and Accessories

Service Offerings (business customers only)

Hosting and Cloud Services (business customers only)

Service, SaaS, IaaS and hosting services are available exclusively to business customers. Consumers may only purchase goods (hardware, software, accessories) once Part C is activated.

1. The presentation of products in the online shop or customer portal at secure2fiber.com does not constitute a legally binding offer but an invitation to place an order (invitatio ad offerendum).

2. The customer submits a binding offer to purchase by completing the order process and clicking the "Buy" / "Order Now" button, or by submitting a written or e-mail order.

3. The Seller will confirm receipt of the order promptly by e-mail (order acknowledgement). This does not constitute acceptance of the offer.

4. The purchase contract is concluded upon dispatch of a separate order confirmation by e-mail or – if no separate confirmation is sent – at the latest upon dispatch of the goods and transmission of the shipping confirmation.

5. The Seller reserves the right to decline orders without stating reasons, in particular in the event of unavailability of goods, reasonable suspicion of abusive ordering, lack of business customer status (while Part C is not active), or violations of §21 (Export Controls).

This section applies exclusively to service and maintenance contracts, not to orders placed via the online shop.

1. Orders are submitted by the Client via e-mail or through the customer portal with a precise description of the task or fault, and entered into the Contractor's order management systems. The Contractor shall provide the Client with the necessary access credentials free of charge for the duration of the contractual relationship. In exceptional cases, orders may be placed by telephone using the number stated in the contact block at the beginning of these GTC.

2. The Contractor shall confirm receipt of the order promptly, including the time of receipt and a reference number.

3. The Contractor shall record the time spent separately per task and activity. The Client may independently check the total time recorded in the ticketing system at any time.

4. The Contractor shall promptly notify the Client of work carried out and, where necessary, communicate interim results or confirm completion of the task.

5. The Client shall designate a responsible contact person for each task. If no contact person is named, the person who reported the task shall be deemed the responsible contact.

6. The reference number must be quoted in all enquiries regarding ongoing tasks.

1. The Client is entitled to request changes to the scope of delivery and/or services after conclusion of the contract, provided such changes are technically and logistically reasonable for the Contractor. The Contractor shall review the change request and notify the Client in text form of its implications, including information on technical feasibility, timelines, acceptance procedures and remuneration. The Client shall decide promptly on whether to proceed.

2. Upon positive decision and agreement on the amended contract terms, the change becomes part of the contract.

3. For technically and economically immaterial change requests, the Contractor may not demand an amendment to the contract terms.

4. The Client shall reimburse the additional costs incurred as a result of the change request, including the Contractor's costs for fulfilling the notification obligation under paragraph 1.

1. The parties shall agree on an acceptance date. If no acceptance date is agreed, acceptance shall take place upon completion of the work.

2. Work shall be subject to an acceptance test after delivery by the Contractor. The Client shall declare acceptance provided the work is free of defects.

3. Acceptance must be declared in text form. In the absence of a formal acceptance declaration, work shall be deemed accepted if the Client has used it for its intended purpose for 14 calendar days outside agreed test procedures without reporting any defects.

1. Manufacturer Status: In the case of OEM-based products (AIMSTRONG appliances), the Seller acts as manufacturer and person placing the product on the market vis-à-vis the customer. The underlying hardware components are sourced from qualified OEM suppliers, inspected by the Seller, loaded with proprietary firmware and software, and marketed as complete appliances.

2. OEM Supplier Changes: The Seller reserves the right to change OEM hardware suppliers, provided the technical specifications and quality of the end products remain equivalent. Any change that affects material product characteristics will be communicated to the customer in text form prior to delivery.

3. Product Designations and Specifications: The Seller's own product data sheets and specifications are authoritative for the scope of delivery, not the data sheets of OEM component suppliers.

4. Conformity and Certifications: The Seller ensures that OEM-based products carry the conformity markings required for the respective target market (in particular CE marking). Corresponding declarations of conformity will be provided to the customer upon request.

5. Spare Parts and Availability: If OEM components of a particular type are no longer available from a supplier (end-of-life), the Seller shall notify the customer without undue delay and, where applicable, identify a successor product or alternative service options.

1. The Contractor (hereinafter also "Licensor") shall provide the Client with the right to use the software of the AIM Product Family specified in the service description (in particular AIMdefense, AIMdesk, AIMcompute, AIMroute, AIMnetworks and firmware integrated in AIMSTRONG appliances) to the functional extent described therein.

2. Open-Source Components: AIMdefense is based on open-source software (in particular OPNsense, Zenarmor and further integrated modules). These components are subject to their respective open-source licences (including BSD-2-Clause, Apache 2.0, GPLv2/v3). By using AIMdefense, the Client acknowledges these licence terms. The Licensor shall provide the Client with a complete licence overview upon request.

3. The Licensor grants the Client the non-exclusive, non-transferable right to use the designated software and firmware for the Client's own business purposes.

4. The Client may only edit or reproduce the software and firmware to the extent covered by intended use or expressly authorised in writing by the Licensor.

5. The Client is not entitled to make the software or firmware available to third parties for independent use, unless such parties are the Client's vicarious agents using the services free of charge.

6. Reverse Engineering: Reverse engineering, decompilation or disassembly of the proprietary portions of the software and firmware is prohibited, except to the extent mandatorily permitted by law (§ 69e UrhG). Open-source components are governed by their respective open-source licence terms.

7. Licence Server / App Store: Use of licence-dependent AIMdefense functions and the integrated AIMdefense App Store requires valid licence registration via the Seller's licence server. The Client shall ensure that the necessary connectivity to the licence server is in place. If licence server access is unavailable, certain functions may be restricted.

1. The Seller shall provide security and functional updates (releases, patches, hotfixes) for AIMSTRONG appliances and AIMdefense products to the extent necessary to maintain contractual conformity.

2. Release Process: New AIMdefense releases undergo a structured development, testing and release approval process (release gate) prior to delivery. Customers with an active service agreement will be informed of new releases by e-mail or via the customer portal.

3. The scope and duration of update provision are governed by the respective product data sheet and the booked support level.

4. Security Patches: Critical security updates are provided as hotfixes outside regular release cycles and communicated separately.

5. The Client is obliged to install security-relevant updates within a reasonable period. The Seller shall not be liable for damage arising from the Client's failure to install known security updates.

1. The Contractor shall provide the Client with virtual storage space. The Contractor does not assume any custodial or safekeeping obligations with respect to transmitted data beyond the contractually agreed service. The Client is responsible for compliance with commercial and tax retention obligations.

2. The extent of available storage space is defined in the service description.

3. In the event of a data migration from the Client's own database, the required details must be communicated to the Contractor at least eight weeks before the intended migration date.

4. The Client is not entitled to make the storage space available to third parties.

5. The Client grants the Contractor the right to reproduce stored data to the extent necessary for the provision of the contractually owed services.

1. This section applies exclusively to the provision of Infrastructure as a Service (IaaS).

2. Availability: The Seller guarantees an availability of the IaaS infrastructure of 99.5% on a monthly average, measured at the handover point to the customer's network. Planned maintenance windows notified to the customer at least 48 hours in advance, and outages due to force majeure, shall not count as unavailability.

3. Data Backup: Responsibility for regular backup of data stored on the IaaS infrastructure lies with the customer, unless Backup as a Service (BaaS) has been expressly agreed. The Seller accepts no liability for data losses attributable to inadequate or faulty backup by the customer.

4. Sub-contractors / Data Centre: The Seller is entitled to engage sub-contractors and third-party data centres for the provision of IaaS services. The customer shall be informed of the data centre operator used and its location. Any change will be communicated to the customer at least four weeks in advance in text form.

5. Resource Usage: The customer is obliged to use the provided resources exclusively in accordance with the contract. Abusive use entitles the Seller to immediately suspend access.

1. The Contractor shall be available for the resolution of faults and functional disruptions in accordance with the response times defined below.

2. Incident Classes:

3. Response Times:

4. A business day is defined as a weekday (Monday to Friday) that is not a public holiday applicable throughout Germany. Business hours begin at 09:00 and end Monday to Thursday at 17:00, Friday at 15:00.

5. If the incident is entered into the order management system by 12:00, the day of entry shall be the start of the response time. For later entries, the following business day applies. For SLA Class 4, the response time begins on the same business day.

6. If the Contractor repeatedly fails to meet response times through its own fault, the Client shall be entitled to terminate the contract for cause.

1. The Client undertakes to fully support the Contractor in carrying out its activities and shall provide the required premises, systems, personnel and documents free of charge.

2. The Client shall provide the systems and telecommunications connections required for remote access (e.g. for remote maintenance of AIM products) free of charge.

3. The Client shall ensure that accident prevention regulations are observed in the premises to be entered.

4. For ISO 27001 (ISMS)-compliant documentation, the Client shall provide a suitable system; otherwise ISO 27001-compliant documentation will be invoiced separately.

5. SaaS/Hosting: The Client shall be responsible for establishing the data connection between its workstations and the defined data handover point. The Client shall ensure that the hardware and software used meets the minimum technical requirements. The Client is obliged to prevent unauthorised access by third parties through appropriate measures and to keep user IDs and passwords confidential.

1. The Seller delivers to the countries listed as delivery countries in the online shop or customer portal.

2. Delivery times are stated on the respective product page and during the ordering process. Stated delivery times are non-binding estimates unless an express delivery date has been agreed. For AIMSTRONG appliances with individual configuration, different delivery times may apply and will be stated separately in the offer.

3. Partial deliveries are permitted to the extent reasonable for the customer. Additional costs arising from partial deliveries shall be borne by the Seller, unless the customer requested the partial delivery.

4. Reservation of Self-Supply: The Seller reserves the right to withdraw from the delivery obligation in the event that goods are unavailable – in particular due to supply difficulties with OEM components, semiconductor shortages or other bottlenecks at upstream suppliers – provided the Seller itself was not supplied in breach of contract by an upstream supplier, the goods were unavailable at the time of contract conclusion, and the Seller promptly informs the customer and refunds any consideration already received.

5. The provisions on transfer of risk upon dispatch are set out for business customers in §B3 and for consumers (once Part C is activated) in §C3.

1. All prices stated in the online shop and customer portal are net prices exclusive of applicable VAT, unless expressly stated otherwise. Shipping costs are shown separately during the ordering process before the order is submitted. Once Part C is activated, consumer prices will be shown inclusive of statutory VAT.

2. Invoices are due for payment within 14 days of the invoice date, unless a different payment term is stated on the invoice or agreed in the offer.

3. If the customer is more than 30 days in arrears with due payments, the Seller reserves the right to suspend further services until the customer has met its payment obligations.

4. Prices and conditions for services are governed by the current price information sheet. If hourly contingents are agreed, the Client undertakes to minimum purchase obligations accordingly.

5. The Contractor may adjust fees at its reasonable discretion in line with cost developments. Price changes will be communicated to the Client in text form at least six weeks before they take effect.

6. Working time exceeding the agreed hourly contingent will be invoiced at the standard hourly rate after service provision.

7. For work at the Client's premises, travel costs will be charged additionally per visit in accordance with the price information sheet.

8. Special provisions on default interest: for business customers see §B4; for consumers (once Part C is activated) see §C4.

1. The contract commences upon signing and has a minimum term as specified in the order form.

2. Either party may terminate the contract after expiry of the minimum term with six months' notice to the end of the calendar year.

3. Termination must be received in writing. The terminating party bears the burden of proof of receipt.

4. The right to extraordinary termination for cause remains unaffected. The Contractor is entitled to terminate without notice in particular if the Client fails to make due payments despite reminder and a grace period.

1. The Seller retains title to the delivered goods until all claims arising from the ongoing business relationship have been paid in full (extended retention of title). Where the customer is a consumer (once Part C is activated), simple retention of title applies until full payment of the respective order.

2. If sold hardware or delivered software is defective, the buyer is entitled to demand subsequent performance within the scope of the applicable statutory provisions. The Seller has the right to choose the type of subsequent performance (repair or replacement) where the buyer is a business customer. For consumers, §C2 applies.

3. If the business customer processes or combines the goods subject to retention of title with other items, the Seller acquires co-ownership of the new item in proportion to the invoice value of the goods subject to retention of title relative to the other processed items at the time of processing.

4. The business customer is entitled to resell the goods subject to retention of title in the ordinary course of business. The customer hereby assigns to the Seller all claims arising from such resale against third parties up to the invoice amount. The Seller accepts this assignment.

1. Returns under the statutory right of withdrawal (consumers, once Part C is activated, see §C1) and any other Seller-accepted returns require prior return authorisation from the Seller. The relevant contact details are set out in the contact block at the beginning of these GTC.

2. Returns in the context of warranty or guarantee claims (RMA – Return Merchandise Authorization) must be initiated via the RMA contact stated in the contact block at the beginning of these GTC. Upon review, the customer will receive an RMA number, which must be affixed prominently to the shipping package. Shipments without an RMA number cannot be processed and will be returned at the sender's expense.

3. Returns must be packaged securely and in a transport-safe manner. The customer is liable for damage resulting from inadequate packaging.

4. The Seller shall bear the cost of return shipping for justified warranty and guarantee claims. In all other cases, the customer bears the shipping costs, unless otherwise agreed by law or contract.

1. The Contractor shall perform the agreed service within the agreed scope and timeframe.

2. Claims for subsequent performance shall become statute-barred after 12 months. Subsequent performance shall initially take the form of remediation.

3. The Contractor shall not be liable if the Client has made modifications to the services provided, unless those modifications had no influence on the defect.

1. If service levels or agreed availability targets are not met for reasons attributable to the Contractor, the Client may assert reduction rights only, without first asserting a claim for subsequent performance.

2. Warranty claims are excluded in the case of disruptions outside the network operated by the Contractor, non-contractual use of systems, payment default, force majeure, or third-party attacks on the infrastructure.

3. Reduction for Hosting Services: The remuneration shall be reduced proportionally by three times the factor (factor 3) by which the agreed availability is undershot. Remuneration for the affected month shall be waived in full if the shortfall exceeds 15%. For SLA Class 4, the remuneration is reduced by 4% per month.

1. The customer warrants that the purchased products – in particular AIMSTRONG appliances, AIMdefense systems, encryption components and other security hardware – will not be resold or transferred to countries subject to export restrictions or sanctions imposed by the EU, the Federal Republic of Germany, the USA or other competent authorities.

2. To the extent that products are subject to EU dual-use regulations (Regulation (EU) 2021/821), the customer is obliged to comply with the applicable licence requirements. The customer shall be liable for all damages and costs arising from any violation.

3. The Seller is entitled to reject orders or unwind concluded contracts if indications of a violation of this clause become known after contract conclusion.

Where software or software-based hardware is supplied (e.g. firmware, operating systems, security suites from third parties), the licence terms of the respective manufacturer (EULA) apply in addition, in particular open-source licence terms applicable to AIMdefense (OPNsense, Zenarmor) and any operating systems or additional software pre-installed on AIMSTRONG appliances. The customer is obliged to accept these terms prior to commissioning. The Seller transfers only such rights as have been granted to it by the respective rights holder. The Seller draws attention to applicable EULA obligations during the ordering process or in the product description.

1. The Seller shall be liable in cases of fraudulent intent, wilful misconduct or gross negligence in accordance with the statutory provisions. The same applies to claims under the German Product Liability Act (ProdHaftG).

2. The Seller shall be liable without limitation where it has given a guarantee for a specific characteristic, and in cases of slight negligence involving injury to life, body and/or health.

3. Damage caused by slight negligence shall only be compensated where a cardinal obligation has been breached.

4. In the event of slight negligence, liability is limited to the typically foreseeable damage, up to a maximum of the order value.

5. Liability for data loss is limited to the effort that would have been required to restore the data from properly backed-up data material.

6. Any further liability is excluded.

7. In cases of force majeure (war, terrorism, pandemics, strikes, energy shortages, supply disruptions by upstream service providers, semiconductor shortages, OEM supply bottlenecks, etc.), the Seller shall be released from its obligation to perform for as long as the impediment persists.

8. The above limitations of liability do not apply to the extent they are incompatible with mandatory consumer protection provisions (relevant once Part C is activated).

1. The contracting parties undertake to maintain confidentiality regarding all confidential matters that come to their knowledge in the course of the business relationship, in particular trade secrets, product architectures, firmware specifications and pricing information, and neither to disclose nor to exploit them in any other way.

2. The confidentiality obligation shall survive the termination of this contract.

1. The contracting parties shall process each other's personal data in compliance with the provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), and exclusively for the purposes agreed under the contract.

2. Details on the collection, processing and use of personal data by the Seller can be found in the Privacy Policy, available at secure2fiber.com/privacy, which forms part of these GTC. Where the performance of the contract involves commissioned data processing, this shall be governed by a separate Data Processing Agreement (DPA) pursuant to Art. 28 GDPR.

1. The Seller reserves the right to amend these GTC with a notice period of at least six weeks before the intended effective date, communicated in text form.

2. If the Client (business customer) does not object to the amendments in writing within six weeks of notification, the amendments shall be deemed approved. The Seller shall draw attention to the significance of silence in the notification.

3. With respect to consumers (once Part C is activated), amendments to these GTC shall only take effect if the consumer has expressly consented. Deemed consent by silence is not effective against consumers.

1. For all disputes arising in connection with the performance and settlement of this contractual relationship, the registered office of the Seller shall be the agreed place of jurisdiction, provided the Client is a business customer. For consumers, the statutory place of jurisdiction applies; mandatory statutory jurisdiction rules in favour of consumers remain unaffected. In the case of international deliveries, §21 (Export Controls) applies additionally.

2. The contractual relationship is governed exclusively by the law of the Federal Republic of Germany, excluding conflict of laws rules and the UN Convention on Contracts for the International Sale of Goods (CISG).

1. The Seller may transfer the rights and obligations under this contract to a third party, provided that third party's qualifications and capabilities ensure contractual performance. The customer shall be informed of such transfer at least four weeks in advance in text form and shall have the right to terminate the contract for cause at the time of transfer. If the customer is a business customer, it hereby irrevocably consents to such assumption of obligations, unless there is cause to object.

2. Amendments and supplements to this contract must be made in writing. This applies equally to amendments to this written form clause.

3. Should individual provisions of these GTC be or become wholly or partially invalid, the validity of the remaining provisions shall not be affected. The invalid provision shall be replaced by the applicable statutory rule.

PART B – SPECIAL PROVISIONS FOR BUSINESS CUSTOMERS

Where the buyer is a business customer, it must inspect the delivered goods promptly upon receipt for defects and notify the Seller of any defects in writing without undue delay, at the latest within seven (7) business days of delivery (§ 377 HGB). This applies in particular to AIMSTRONG appliances and AIMdefense products with regard to apparent hardware defects, incorrect firmware versions or incomplete deliveries. Hidden defects must be reported without undue delay upon discovery. Failure to give timely notice shall result in the goods being deemed approved.

For business customers, the limitation period for warranty claims in respect of goods – other than claims for damages – is twelve (12) months from the transfer of risk. For software products and products with digital elements (in particular AIMdefense firmware, AIMdesk, AIMroute, AIMnetworks), the Seller shall provide the necessary security and functional updates during the warranty period to the extent required to maintain contractual conformity (§ 327f BGB).

For business customers, the risk of accidental loss and accidental deterioration of goods passes to the buyer upon handover to the carrier, freight forwarder or other person designated to carry out the shipment (§ 447 BGB).

In the event of default, default interest shall be charged – in addition to any reminder fees – at a rate of nine (9) percentage points above the applicable base interest rate of the Deutsche Bundesbank (§ 288 para. 2 BGB).

1. If the business customer processes or combines the goods subject to retention of title with other items, the Seller acquires co-ownership of the new item in proportion to the invoice value of the goods subject to retention of title relative to the other processed items at the time of processing.

2. The business customer is entitled to resell the goods subject to retention of title in the ordinary course of business. The customer hereby assigns to the Seller all claims arising from such resale against third parties up to the invoice amount. The Seller accepts this assignment.

3. The business customer is authorised to collect the assigned receivable. The Seller reserves the right to collect the receivable itself once the business customer fails to duly meet its payment obligations.

PART C – SPECIAL PROVISIONS FOR CONSUMERS

⚠️ NOTICE: THIS PART IS NOT YET ACTIVE.

Secure 2 Fiber GmbH currently supplies exclusively to business customers within the meaning of § 14 BGB. Contracts with consumers (§ 13 BGB) are not currently offered and are not possible. Part C is fully drafted and will enter into force automatically as soon as Secure 2 Fiber GmbH commences consumer business. Activation will be effected by publication of an updated version of these GTC with a corresponding notice.