Section 1 — Scope and Subject Matter

(1) These Terms of Service (hereinafter "Terms") apply to all contracts between GraphCapsule, operated by Oliver Czempas, Feldbergstrasse 18, 68163 Mannheim, Germany (hereinafter "Provider"), and the customer (hereinafter "Customer") regarding the use of the cloud-based SaaS service "GraphCapsule" (hereinafter "Service").

(2) The Service comprises the automated backup, archiving, full-text search, and restoration of data from Microsoft 365 environments (in particular Exchange Online, OneDrive for Business, SharePoint Online, and Microsoft Teams) in accordance with the applicable Service Description.

(3) These Terms apply exclusively to businesses within the meaning of Section 14 of the German Civil Code (BGB). By entering into this contract, the Customer confirms that the Service is used exclusively within the scope of their commercial or independent professional activity.

(4) Any deviating, conflicting, or supplementary terms and conditions of the Customer shall not become part of the contract unless the Provider expressly agrees to their applicability in writing.

(5) The current Service Description for the selected plan (Starter, Professional, or Enterprise) forms an integral part of these Terms and is available on the Provider's website.

Section 2 — Scope of Services

(1) The Provider delivers the following core services under the selected plan:

• Automated Backup: Regular, incremental backup (delta sync) of the Customer's Microsoft 365 data via the Microsoft Graph API.
• Encryption: Encryption of all backed-up data with AES-256-GCM at rest and TLS 1.3 in transit.
• Point-in-Time Restore: Restoration of individual items, entire mailboxes, or multiple items (bulk) to a specific point in time.
• Full-Text Search: Searchability of backed-up data through an integrated search function.
• Storage: Retention of backed-up data according to the Customer's configured retention policy within the limits of the selected plan.

(2) The exact feature set per plan (Starter, Professional, Enterprise) is defined in the Service Description.

(3) The Provider is entitled to expand or improve the Service's functionality at any time, provided this does not reduce the contractually agreed scope of services.

(4) The Service depends on the availability and functionality of the Microsoft 365 Graph API. The Provider has no influence over changes, restrictions, or outages on Microsoft's part. API rate limits, interface changes, or service interruptions by Microsoft may affect the completeness and timeliness of backups.

(5) The Provider does not guarantee that every single data element will be successfully captured in every backup. Transient errors, API restrictions by Microsoft, and data changes or deletions between two backup cycles may result in individual elements not being included in the backup. The Provider undertakes commercially reasonable efforts to maximize the completeness and reliability of backups.

Section 3 — Contract Formation and Term

(1) The contract is formed upon the Customer's registration on the Provider's platform and acceptance of these Terms.

(2) The Provider may grant the Customer a free trial period of up to fourteen (14) calendar days. During the trial, the Customer may use the Service within the scope of the Starter plan. The trial ends automatically unless the Customer activates a paid plan within the trial period. Data backed up during the trial will be deleted within thirty (30) calendar days after the trial ends if no paid plan is activated.

(3) The contract term depends on the selected billing cycle:

• Monthly billing: The contract runs for an indefinite period and may be terminated by either party with fourteen (14) calendar days' notice to the end of the respective billing month.
• Annual billing: The contract has a minimum term of twelve (12) months and automatically renews for further twelve (12) month periods unless terminated with thirty (30) calendar days' notice before the end of the respective term.

(4) Termination must be in text form (email is sufficient).

(5) Each plan requires a minimum number of licensed mailboxes (Starter: 5, Professional: 10, Enterprise: 100). The minimum number always serves as the billing floor.

Section 4 — Pricing and Billing

(1) The fee consists of two components:

• Platform License Fee: A monthly or annual fee per licensed mailbox according to the selected plan. The license fee is due in advance.
• Storage Fee (Overage): A usage-based fee per gigabyte (GB) per month for storage consumption exceeding the plan's included quota. The storage fee is billed in arrears on the following month's invoice.

Current Pricing

All prices are exclusive of applicable statutory VAT.

(2) Storage consumption is calculated based on the actual stored data volume after compression and encryption (Stored GB). The overage amount is calculated from the average daily storage consumption above the included quota during the respective billing period (average method). Short-term consumption peaks are not billed separately.

(3) Under the Enterprise plan, the included quota is calculated as a shared storage pool. The total quota is the number of licensed mailboxes multiplied by the included storage per mailbox. This pool can be flexibly distributed across individual mailboxes.

(4) If the included quota is exceeded, backup services will not be interrupted or restricted. The protection of Customer data takes priority. The applicable overage fee will be shown on the following month's invoice.

(5) The Provider will notify the Customer by email and via the dashboard when 80% and 95% of the included quota are reached.

(6) Payment is made by credit card, SEPA direct debit, or another payment method offered by the Provider. If the Customer defaults on payment, the statutory default consequences apply (Sections 286 et seq. BGB). The Provider is entitled to suspend access to the Service after unsuccessful reminder with a reasonable grace period. Backed-up data will not be deleted during suspension.

(7) The Provider is entitled to adjust prices once per calendar year. Price adjustments will be announced to the Customer at least thirty (30) calendar days before taking effect in text form. In the event of price increases, the Customer has a special right of termination pursuant to Section 12(5).

(8) Individual volume discounts may be agreed for Enterprise customers with more than five hundred (500) mailboxes. Such agreements require written form.

Section 5 — Customer Obligations

(1) The Customer is obligated to:

• establish and maintain the connection to their Microsoft 365 environment required for the Service, in particular to grant and not revoke the OAuth authorization with the required permissions;
• configure a retention policy appropriate to their data protection needs and legal retention obligations;
• correctly configure and maintain mailboxes and user accounts in their Microsoft 365 environment;
• regularly monitor the backup status via the Provider's dashboard and report irregularities to the Provider without delay;
• review the redundancy level recommended by the Provider at contract conclusion and select a redundancy option appropriate to their data protection needs (see Section 6);
• keep their Service credentials confidential and protect them from third-party access;
• use the Service only in accordance with these Terms and applicable laws.

(2) The Customer ensures that they have the required rights and authorizations to have the data contained in their Microsoft 365 environment backed up and processed by the Provider, in particular with regard to personal data of third parties.

(3) The Customer bears sole responsibility for compliance with their own legal and regulatory obligations (in particular commercial and tax retention requirements). The Service supports the Customer in fulfilling these obligations but does not replace independent review and implementation.

(4) When supplying their own encryption key, the Customer is solely responsible for the secure storage and availability of their Key Encryption Key (KEK). The Provider cannot decrypt data encrypted with the Customer's KEK. Loss of the KEK leads to the irrevocable unreadability of the affected backup data. The Provider is not liable for data losses attributable to the loss or compromise of the Customer's KEK.

Section 6 — Data Storage and Redundancy

(1) The Customer's backed-up data is stored on S3-compatible object storage infrastructure. Primary storage is located in Germany, secondary storage in Finland — exclusively within the European Union.

(2) Under the standard redundancy level (included in all plans), data is stored within a single region. The storage provider maintains triple replication (3x) at the infrastructure level.

(3) Standard redundancy protects against hardware failures of individual storage nodes. It does not protect against total failure of an entire data center region, simultaneous failure of multiple availability zones, or catastrophic events affecting an entire data center.

(4) The Provider may offer additional redundancy options as add-on services, in particular: Backup Shield (geo-redundant replication to a separate EU data center with ransomware detection), cross-region replication, and External Backup / BYOB (encrypted copy to a customer-provided S3 storage). Pricing for add-on services is listed in the Service Description.

(5) The Provider recommends a redundancy level appropriate to the Customer's data protection needs at the time of contract conclusion. This recommendation is documented in writing by the Provider (email is sufficient). The final choice of redundancy level rests with the Customer.

(6) The Customer bears the residual risk for the redundancy level they have selected. If the Customer decides against a higher redundancy level despite the Provider's recommendation, the Provider cannot be held liable for data losses that could have been avoided with the recommended, higher redundancy level, provided the Provider has fulfilled its recommendation and documentation obligation under paragraph (5).

Section 7 — Liability and Limitation of Liability

(1) The Provider is liable without limitation for damages arising from injury to life, body, or health based on an intentional or negligent breach of duty by the Provider, its legal representatives, or vicarious agents.

(2) The Provider is liable without limitation for damages based on intent or gross negligence of the Provider, its legal representatives, or senior employees.

(3) In cases of gross negligence by ordinary vicarious agents, liability is limited to the typically foreseeable damage.

(4) In cases of slight negligence in the breach of material contractual obligations (cardinal obligations) — i.e., obligations whose fulfilment is essential for the proper performance of the contract and on whose compliance the Customer may regularly rely — liability is limited to the typically foreseeable damage.

(5) The Provider's liability for damages under paragraphs (3) and (4) is capped at the sum of fees paid by the Customer to the Provider in the twelve (12) months preceding the damage-causing event. If the contract has been in effect for less than twelve (12) months at the time of the damaging event, the fees paid to date are extrapolated to a twelve-month period.

(6) The Provider is not liable for:

• indirect and consequential damages, in particular lost profits, business interruption damages, or other financial losses — this does not apply in cases of intent and gross negligence under paragraphs (1) and (2);
• data losses where the Customer has not fulfilled their obligation to monitor backup status (Section 5(1)) or to choose appropriate redundancy (Section 6);
• unavailability, changes, or errors of the Microsoft 365 Graph API or other third-party services;
• outages or data losses of the infrastructure provider, insofar as the Provider has selected and monitored them with the care required in commercial transactions;
• data losses resulting from the loss or compromise of an encryption key supplied by the Customer;
• incomplete backups caused by API rate limits, transient errors of the data source, or data changes/deletions between two backup cycles.

(7) The Provider delivers the Service with the care required in commercial transactions. It owes the professional execution of the Service, but not a specific backup success for every individual data element.

(8) Force Majeure: The Provider is not liable for non-performance or delayed performance of its contractual obligations insofar as this is due to circumstances beyond its reasonable control, including natural disasters, war, terrorism, pandemics, government orders, strikes, total data center failures, widespread power outages, or cyberattacks on infrastructure providers.

(9) Liability under the German Product Liability Act and under Art. 82 GDPR remains unaffected by the above provisions.

Section 8 — Data Protection and Data Processing

(1) The Provider processes the Customer's personal data exclusively on behalf of and according to the Customer's instructions within the meaning of Art. 28 GDPR. The details of data processing are set out in a separate Data Processing Agreement (DPA), which forms part of this contract.

(2) Within the data processing chain: the Customer is the Controller (Art. 4(7) GDPR), the Provider is the Processor (Art. 28 GDPR). Sub-processors for storage infrastructure are listed in the Data Processing Agreement (DPA). Microsoft Corporation is the data source and not a sub-processor of the Provider.

(3) The Provider will inform the Customer of any intended changes regarding sub-processors at least thirty (30) calendar days before the change. The Customer may object within fourteen (14) calendar days.

(4) The Provider implements the required technical and organizational measures pursuant to Art. 32 GDPR. Details are described in the annex Technical and Organizational Measures (TOM).

(5) All Customer data is stored and processed exclusively within the European Union.

(6) After termination of the contract, the Provider makes the Customer's data available for export pursuant to Section 12(6). After expiry of the data export phase, all Customer data is irrevocably deleted.

(7) Where the Customer has supplied their own encryption key and revoked the Provider's ability to unwrap it, the Provider cannot decrypt Customer data. The responsibility for decryption capability lies exclusively with the Customer.

Section 9 — Availability and Service Level Agreement (SLA)

(1) The availability commitment depends on the selected plan:

• Starter: The Provider delivers the Service on a best-effort basis without a binding availability commitment.
• Professional and Enterprise: The Provider guarantees a monthly availability of at least 99.9%.

(2) The Service is considered available when the Provider's API is reachable and backup jobs can be executed as scheduled.

(3) The following are not counted as downtime: scheduled maintenance (at least 48 hours advance notice), outages of the Microsoft 365 Graph API, force majeure events (Section 7(8)), and outages due to violations of Customer obligations (Section 5).

(4) If the guaranteed availability is not met, the Customer is entitled to an SLA credit:

(5) SLA credit claims require the Customer to report the shortfall within seven (7) calendar days after the end of the affected month. Credits are applied to the next invoice. Further claims under Section 7 remain unaffected.

Section 10 — Intellectual Property

(1) All rights to the software, platform, and underlying technologies remain with the Provider. The Customer receives a non-exclusive, non-transferable, revocable right of use for the duration of the contract.

(2) Data backed up by the Customer through the Service (Customer Data) remains the sole property of the Customer. The Provider acquires no rights to Customer Data beyond what is necessary for service delivery.

(3) The Provider is not entitled to use Customer Data for its own purposes, in particular not for advertising, profiling, or AI model training.

(4) The Provider has no lien on Customer Data. Even in the case of outstanding claims, the Customer's right to data export under Section 12(6) remains intact. However, the Provider may restrict access to the Service (except for the export function) in such cases.

Section 11 — Confidentiality

(1) The parties undertake to treat all confidential information of the other party obtained in connection with the contractual relationship as strictly confidential and to use it only for the purposes of this contract.

(2) The confidentiality obligation does not apply to information that was already publicly known at the time of disclosure, was already known to the receiving party, was communicated by an authorized third party, was independently developed, or must be disclosed due to legal provisions or official orders.

(3) The confidentiality obligation survives termination of the contract by three (3) years.

Section 12 — Termination and End of Contract

(1) Ordinary termination is governed by Section 3(3).

(2) The right of both parties to extraordinary termination for cause remains unaffected.

(3) Cause for extraordinary termination exists in particular when a party breaches a material contractual obligation and fails to remedy the breach within fourteen (14) calendar days of written notice, when insolvency proceedings are opened against a party's assets, or when the Customer defaults on payment despite a reminder and reasonable grace period.

(4) Extraordinary termination must be in text form and state the reason for termination.

(5) Special termination right for price increases: In the event of a price increase pursuant to Section 4(7), the Customer is entitled to terminate the contract with thirty (30) calendar days' notice effective on the date the price increase takes effect.

(6) Data export phase: After termination takes effect, the Customer has thirty (30) calendar days to export their backed-up data via the Service's export function. After expiry of the data export phase, all Customer data is irrevocably deleted.

(7) In the case of annual prepayment, no pro-rata refund is owed upon ordinary termination by the Customer. In the case of justified extraordinary termination by the Customer, a pro-rata refund for the unused period is owed.

(8) Outstanding storage overage fees for the last usage period are settled with the final invoice.

Section 13 — Amendments to Terms

(1) The Provider is entitled to amend these Terms with future effect, insofar as the amendment is reasonable for the Customer taking into account the Provider's interests.

(2) The Provider will notify the Customer at least thirty (30) calendar days before the amendment takes effect. The notification includes the amended provisions, the effective date, and information about the right to object.

(3) The Customer may object to the amendment within thirty (30) calendar days of receipt. Upon timely objection, the Customer has a special right of termination. The previous Terms apply until the end of the contract.

(4) If the Customer does not object in time and continues using the Service after the amendment takes effect, the amended Terms are deemed accepted.

Section 14 — Final Provisions

(1) The laws of the Federal Republic of Germany apply, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

(2) If the Customer is a merchant (Kaufmann) within the meaning of the German Commercial Code (HGB), a legal entity under public law, or a special fund under public law, the exclusive place of jurisdiction is the Provider's registered office (Mannheim).

(3) Should individual provisions of these Terms be or become invalid, the validity of the remaining provisions shall not be affected.

(4) Ancillary agreements, amendments, and supplements to this contract require written form. This also applies to the waiver of this written form requirement.

(5) The Customer may only assign rights and obligations under this contract to third parties with the Provider's prior written consent.

Annexes

The following documents form an integral part of these Terms:

• Annex 1: Service Description (plan tiers, feature matrix, current pricing)
• Annex 2: Data Processing Agreement (DPA) pursuant to Art. 28 GDPR
• Annex 3: Technical and Organizational Measures (TOM)

Contact

If you have questions about these Terms, please contact: