The terms contained in the Agreement and these General Terms and Conditions beginning with a capital letter are defined and have the meaning as set out in this Article:
Agreement: any agreement concluded between CM.com Germany GmbH and Client, including all associated schedules, to which these General Terms and Conditions apply. CM.com Germany GmbH: the private limited liability company CM.com Germany GmbH (Handelsregister B des Amtsgericht Würzburg HRB 13092).
Codes of Conduct: (i) all applicable laws and regulations, government advice and codes of conduct concerning telecommunication services, unfair competition ("das UWG) and privacy laid down by competent authorities or industry in the country where the Service and/or the End User Service is delivered; and also (ii) all regulations, guidelines, conditions, policy rules and/or other requirements regarding telecommunication services, unfair competition and privacy that are used by operators in the country where the Service and/or the End User Service is delivered.
Connection: the connection between CM.com Germany GmbH's Gateway and the Operator and/or the connection between CM.com Germany GmbH's Gateway and the Client.
Client: every natural person or legal entity with whom CM.com Germany GmbH concludes an Agreement pre-paid or post-paid, negotiates on its formation, or towards whom CM.com Germany GmbH performs any legal act in relation to the Service.
End User: a natural person who is in possession of or makes use of a mobile telephone and/or fixed line and consequently uses the Client's End User Services.
End User Service: service provided by Client, via the Gateway of CM.com Germany GmbH. The End User Service contains, among others, the content of the messages and the promotion of the End User Service.
Gateway: the system of CM.com Germany GmbH that creates the connection between a GSM network and the system of the Client.
Keyword: unique combination of letters before the first space in a telephone message, by which the Gateway recognizes the End User Service as such.
Message Traffic: message traffic from and to a mobile telephone and/or fixed line.
Service: the services CM.com Germany GmbH is to provide to the Client under the Agreement.
Short code: a shortened number intended to offer mobile telephone services other than for spoken communication.
Working Day: Monday to Friday from 8.30 a.m. to 5.00 p.m. Central European Time (CET), excluding generally recognized public holidays in Germany.
2.1 The General Terms and Conditions apply to all requests, quotations and Agreements between CM.com Germany GmbH and the Client, unless the Parties have expressly agreed otherwise. The applicability of any general (purchasing) conditions from Client is hereby rejected.
2.2 The applicable Codes of Conduct also apply to the End User Service, and supersede the provisions of the Agreement or these General Conditions in case of conflict. The Client accepts the aforementioned Codes of Conduct. Upon request CM.com Germany GmbH shall inform the Client concerning the contents of the requested aspects or parts of said Codes of Conduct. If and insofar for any reason whatsoever the provisions of the Codes of Conduct shall be deemed not to apply to the relations between CM.com Germany GmbH and the Client, or be declared inapplicable, the provisions of the Agreement and these General Terms and Conditions shall apply.
3.1 All offers made by CM.com Germany GmbH are without obligation unless the offer expressly states otherwise in writing.
3.2 Insofar as not stated otherwise, an agreement with CM.com Germany GmbH shall not be concluded until CM.com Germany GmbH has expressly accepted or confirmed an order to that effect in writing. CM.com Germany GmbH expressly reserves the right to amend its prices with regard to price lists, brochures, information on websites and other information provided in the context of offers.
4.1 All prices are in Euros and are exclusive of turnover tax (VAT) and any other levies imposed by the authorities.
4.2 Unless a fixed price has been expressly agreed, CM.com Germany GmbH is entitled to change agreed prices, rates and credit valuations periodically by means of written notification to the Client. Changes shall apply with due observance of a period of at least 1 (one) month following the written notification. The Client has to accept the change, either explicitly or by continuous use of the service. If the Client does not accept a price change, he will be entitled to terminate the Agreement with effect from the date the price changes enters into force. In the case the Client objects against a price change, CM.com Germany GmbH will be entitled to terminate the Agreement with two weeks’ notice,
4.3 CM.com Germany GmbH is in every instance entitled to pass on price increases arising from an obligation pursuant to legislation and regulations, from an increase in the purchase price of messages or from rates changes effected by operators. CM.com Germany GmbH shall inform the Client in advance of such price increases as much as possible.
4.4 Unless the Agreement contains express different payment terms, in which case the payment term stated in the Agreement will apply, the Client shall pay all invoices without suspension, set-off or deduction within fourteen (14) days of the invoice date.
4.5 The unit sending price for the pre-paid Client is determined by the current tariff class of the pre-paid Client which can be consulted after login.
4.6 At the start of the Agreement CM.com Germany GmbH is entitled to demand payment of a deposit. During the term of the Agreement the deposit may be adjusted after mutual consultation. Upon termination of the Agreement the deposit will be refunded to the Client after set-off of the deposit against the amounts then due by the Client to CM.com Germany GmbH. Refund will take place within two (2) whole calendar months following termination of the Agreement.
4.7 In the event that the Client fails to pay CM.com Germany GmbH the amounts due within the agreed period, statutory commercial interest shall be due by Client on the outstanding amount without any notice of default being required.
4.8 The Client is responsible for payment of the applicable turnover tax (VAT) on its End User Service. The Client shall indemnify CM.com Germany GmbH for and against all claims by the tax authorities in this regard and shall hold CM.com Germany GmbH harmless for all losses, penalties and costs arising there from.
4.9 Charges are incurred for the use of some Services, which are debited from Clients’ SMS account. Services subject to charges can only be used if the minimum payment amount as agreed in the Agreement has been paid into the pre-paid Clients’ account.
4.10 Pre-paid credits and balance can be used by the pre-paid Client the day following the day CM.com Germany GmbH has received the money.
4.11 Balance of the pre-paid Client will expire three (3) years after the calendar year in which the pre-paid Client purchased the balance.
4.12 The pre-paid Client is in default when a credit card payment is being charged back. CM.com Germany GmbH is entitled to close down the pre-paid Client’s account when a credit card payment is being charged back.
5.1 The Client shall ensure that a continuously working Connection is set up and maintained between the Client’s platform and CM.com Germany GmbH’s platform.
5.2 The Client will ensure that the data which give access to CM.com Germany GmbH’s system are securely stored.
5.3 All services that are only available by access with the password should only be used by registered Clients. It is not permitted to authorize use to other persons.
5.4 The Client shall only use the Service for purposes as agreed and described in the Agreement. Any change to the Service is to be requested in writing.
5.5 The Client is responsible for the content of messages sent by the Client including as to the identity of the relevant End User (including as to whether such End User has "opted out" of receiving the applicable Message Traffic), and guarantees that these comply with the applicable Codes of Conduct. The Client will not send unsolicited traffic, nor other unethical, punishable or otherwise illicit traffic or content.
5.6 CM.com Germany GmbH is not responsible for sent messages being correctly received by the End User, insofar as an error appears outside the CM.com Germany GmbH server on message transmission.
5.7 CM.com Germany GmbH assumes no responsibility for the sending and receipt of data services in the network of a foreign operator, particularly in the foreign network of mobile radio devices, since these reside in the sole area of responsibility of the network provider.
5.8 The Client will send CM.com Germany GmbH the full name of its company, its address, Chamber of Commerce number and VAT number, and the name of its director(s) who are authorized to represent it. Changes to these details must be passed on immediately to CM.com Germany GmbH in writing.
5.9 The Client accepts that CM.com Germany GmbH may be obliged by operators and/or the competent authorities:
a. to provide the data referred to in the previous paragraph of other parties that are being connected via Client. Client shall execute the request of CM.com Germany GmbH within 2 (two) Working Days;
b. to add the data referred to in the previous paragraph to an electronic database that is managed by or on behalf of an operator and/or a competent authority.
5.10 The Client is obliged to cooperate with any possible audit which investigates whether the Client is acting in accordance with the Codes of Conduct.
5.11 The Client is obliged to notify large quantities of messages (> 50,000 p/d) to CM.com Germany GmbH at least 10 (ten) Working Days in advance.
5.12 The Client is obliged to give its full cooperation to the Client acceptance procedures of operator(s) and if need be to provide information on its financial position in that context.
6.1 The Client warrants that the content and the promotion of the End User Service under no circumstances infringe the (intellectual property) rights of third parties.
6.2 The Client will indemnify CM.com Germany GmbH against all claims by authorities, organizations and institutions that supervise compliance with the Codes of Conduct applicable to the End User Service, and also all claims made by operators in connection with compliance with the Codes of Conduct applicable to the End User Service, and will compensate CM.com Germany GmbH for all losses, penalties and costs arising there from.
6.3 CM.com Germany GmbH will not be responsible for any Service failures or faults which occur, or losses suffered by the Client, as a result of a breach by the Client of the provisions of this Agreement, including but not limited to the Client's obligations in Article 5.
6.4 The Client will indemnify CM.com Germany GmbH against misuse of pre-paid balance by third parties.
7.1 If the Client acts contrary to an obligation under the Agreement, these General Terms and Conditions and/or the Codes of Conduct, CM.com Germany GmbH is entitled to suspend provision of the Service.
7.2 The Client remains liable for payments for the period that the provision of the Service is suspended in accordance with the provisions of this Article.
7.3 As soon as the reason for suspension in accordance with the provisions of this Article is removed by the Client, CM.com Germany GmbH shall resume delivery of the Service unless CM.com Germany GmbH is of the view that the nature and/or frequency of the Client's is such that the provision of the Services should be cancelled permanently. If applicable, the activation costs which CM.com Germany GmbH incurs in this respect will be charged to the Client.
8.1 Client is responsible for the sending and/or delivery of Traffic up to the point of interconnection with the Gateway of CM.com Germany GmbH. Client is responsible for appropriate encryption and security of its Message Traffic.
8.2 CM.com Germany GmbH makes no warranty or guarantee that any Traffic will be correctly delivered to or received by End Users after leaving the Platform of CM.com Germany GmbH. CM.com Germany GmbH provides no warranty or guarantee on behalf of any carrier and/or operator regarding system capacity, throughput, response times or delivery. CM.com Germany GmbH cannot guarantee that Message Traffic will be accepted by any operator or that any of the operators will maintain connectivity with CM.com Germany GmbH.
9.1 CM.com Germany GmbH is entitled to set off the amounts the Client owes to it, including the amounts referred to in Articles 6.2, against the amounts CM.com Germany GmbH owes to the Client, including the revenue generated by CM.com Germany GmbH for the Client.
9.2 If CM.com Germany GmbH and the Client have concluded several Agreements, the amounts reciprocally due on the basis of the various Agreements can be set off by CM.com Germany GmbH, regardless of the Agreement from which the payment obligations in question derive.
10.1 If the Client disputes the accuracy of an invoice sent by CM.com Germany GmbH, the Client will make this motivated known within 10 (ten) Working Days after the date of the invoice in question by registered post to CM.com Germany GmbH. It is only possible to lodge a dispute to an invoice if the amount in dispute is greater than €150.00 (excluding taxes) and greater than three (3%) percent of the invoice amount (excluding taxes).
10.2 The Client will only be entitled to suspend payment of the disputed part of the total amount until the dispute has been resolved, if the amount disputed by the Client exceeds 5% of the total amount of the invoice in question (excluding VAT). If the dispute is not resolved within 20 (twenty) Working Days after the due payment date of the invoice in question, the Parties will be able to submit the dispute to an external expert. This external party will be appointed in mutual consultation. The Parties will also make agreements in this regard concerning the costs involved in engaging the external party.
11.1 The Parties undertake reciprocally, not to communicate in any way the content of the Agreement or any information of which it knows or should know that it is confidential and which originates from the other Party or direct business relations of the other Party, to third parties without the prior written consent of the other Party. The provisions of this Article do not apply if disclosure is required by the authorities or by the operator(s) concerned.
11.2 The Client solely receives the user rights and authorities expressly granted under the Agreement, these General Terms and Conditions or otherwise, and for the remainder shall not disclose, reproduce or make copies of any materials it receives on the basis of this Agreement from CM.com Germany GmbH, nor shall the Client process or modify these materials, without prejudice to further arrangements between CM.com Germany GmbH and the Client in this matter.
11.3 If so desired, the Client will have to arrange for message encryption itself.
11.4 Personal data of the Client is collected by CM.com Germany GmbH at registration. This data is required for contract management and customer support. The data can additionally be used for statistical research, including demography, user behavior and interests.
11.5 CM.com Germany GmbH reserves the right to allow the competent authority, the operator, the aggregator, or an End User to view the Message Traffic.
11.6 For reasons of prosecution CM.com Germany GmbH logs specific data emerging from the sending of a message (IP addresses), which may be passed on under certain requirements (for example on request of prosecuting authorities).
12.1 The Parties accept and respect each other's intellectual and other property rights. All intellectual property rights to any materials, developed by CM.com Germany GmbH for or made available to the Client on the basis of the Agreement, such as equipment, software, analyses, designs, documentation, reports and/or offers, and any preparatory material belonging thereto, shall solely be held by CM.com Germany GmbH and/or its licensors.
13.1 The Client recognizes that access to the internet, the GSM network and other communication media is subject to risks in relation to authorizations, authenticity, data security, privacy, availability of services, reliability of transmission, etc. The Client recognizes that he/she is entirely and solely liable for such risks and their consequences.
13.2 CM.com Germany GmbH is solely liable for losses caused by its intent or gross negligence ("Vorsatz oder grobe Fahrlässigkeit") or that of its representatives and sub-contractors, and, if not intentionally caused, only for losses foreseeable for CM.com Germany GmbH.
13.3 If CM.com Germany GmbH suffers loss as a consequence of the Client acting contrary to an obligation under the Agreement, these General Terms and Conditions or the Codes of Conduct, the Client is obliged to compensate CM.com Germany GmbH for the resulting loss.
13.4 The parties shall not be liable for, loss due to loss of data or data files, or loss due to business stagnation. In particular, CM.com Germany GmbH is not liable for loss of income by the Client because the Client did not set up correct rates for the Message Traffic.
13.5 However, the limitation on liability specified in Article 13.2 and 13.4 shall cease to apply if and insofar as the loss is due to the willful intent or gross negligence of the liable party, as well as in case of damage to life, body and health or statutory product liability (pursuant to the "Produkthaftungsgezsetz").
13.6 Client can agree to purchase beta releases of Services (meaning Services under development and not final yet, beta stage). Those services may have some irregularities that still need to be worked out. As the Client has accepted a beta release of a service, CM.com Germany GmbH can’t be held liable for any loss or damage due to this service.
13.7 No right to compensation shall ever arise unless the party in question reports the loss to the other party in writing within 10 (ten) Working Days after it has arisen. The other party then has 10 (ten) Working Days to remedy the loss, if possible.
14.1 CM.com Germany GmbH is not bound to meet any obligation under the Agreement if it is prevented from doing so as a consequence of force majeure ("höhere Gewalt"'). The term 'force majeure' is used in this context to include but is not limited to: government interventions, strikes, acts of terrorism or threat thereof, interruption of operations, energy disruptions, interruptions in telecommunications facilities of third parties, failure or late compliance by ancillary suppliers of CM.com Germany GmbH or other third parties engaged by CM.com Germany GmbH, as well as every other circumstance that CM.com Germany GmbH could not reasonably have avoided or prevented, which creates an obstacle to the normal performance of the Agreement.
14.2 If CM.com Germany GmbH is prevented from complying with its obligations due to force majeure, it shall make this known to the Client within 10 (ten) Working Days following the day on which the situation of force majeure arose.
15.1 The post-paid Client has the right to appoint an external expert at most once per contract year to audit the quality of the Gateway and the processes at CM.com Germany GmbH. CM.com Germany GmbH will cooperate with such audit.
15.2 CM.com Germany GmbH is entitled to request that the external expert signs a confidentiality declaration in favor of CM.com Germany GmbH (of which CM.com Germany GmbH shall receive a copy). The confidentiality declaration shall contain the terms and conditions that are usual for this type of declaration.
15.3 The time of the audit will be decided in mutual consultation. The post-paid Client shall ensure that audits hinder CM.com Germany GmbH's operations as little as possible.
16.1 The Agreement is entered into for the duration agreed between the Parties in the Agreement, failing which a period of 2 (two) year shall apply.
16.2 The Agreement shall every time be tacitly renewed for the duration of the original period unless either CM.com Germany GmbH or the Client terminates the Agreement for convenience in writing by giving 3 (three) months' notice before the end of the period concerned.
16.3 The Client is never entitled to terminate the Agreement for convenience prematurely except for the pre-paid Client who can terminate the Agreement at any time for convenience in writing. If at the time of such termination the pre-paid Client has refund left, CM.com Germany GmbH shall not restitute this remaining refund to the pre-paid Client.
16.4 CM.com Germany GmbH, is entitled to refuse a pre-paid Client registration to its’ service without giving reasons and to terminate an existing membership without giving reasons. Registration may only be made once per person. The account will be deleted if the account is not charged within three (3) months of registration.
16.5 Either Party may terminate the Agreement for cause, wholly or partially, by registered letter if the other Party imputably fails to comply with its obligations under the Agreement, and – insofar as compliance is permanently impossible – if, after sending the most detailed possible written notice of default while allowing a term of 10 (ten) Working Days to remedy the failure, the other party continues to fail to comply.
16.6 Either Party may terminate the Agreement for cause, wholly or partially and with immediate effect, by registered letter without need for notice of default:
a. if the other Party – whether temporarily or not – is granted suspension of payments, or if a petition in the other Party's bankruptcy is filed, or if the other Party is declared bankrupt, , or if a significant part of the other Party’s assets are seized, or the other Party’s business is liquidated or terminated other than for the purposes of restructuring or merging undertakings, or if the other Party transfers business activities relevant to the implementation of the Agreement to a third party;
b. if the situation of force majeure as referred to in Article 14 lasts longer than 20 (twenty) Working Days;
c. if such termination is required by the authorities or because of changes to the terms and conditions of operator(s).
16.7 If at the time of such termination as is referred to in Article 16.5 and 16.6 the Client has already received any performance in the execution of the Agreement, such performance and any payment obligation connected therewith shall not be subject to any obligation to undo the Agreement unless the Client demonstrates that CM.com Germany GmbH is in default with respect to such performance. Any amounts invoiced by CM.com Germany GmbH before the termination in connection with matters already performed or provided by the same in execution of the Agreement shall remain fully due subject as provided in the preceding sentence and shall become immediately payable upon termination.16.8 Provisions which by their nature are intended to survive termination of the Agreement shall continue to apply after the end of the Agreement. These provisions among other things form part of articles regarding warranties & indemnification (6), setting-of (9), confidentiality & privacy (11), intellectual property rights (12), liability (13), force majeure (14) and applicable law & disputes (19) of these General Terms and Conditions, as well as this and the previous paragraph in this Article.
17.1 The Client is not entitled to transfer rights and obligations under this Agreement wholly or partially to a third party without CM.com Germany GmbH’s prior permission, which shall not be withheld on unreasonable grounds. CM.com Germany GmbH is entitled to attach conditions to the granting of such permission.
17.2 CM.com Germany GmbH is entitled without prior notice or permission to transfer the rights and obligations deriving from the Agreement wholly or partially to a group company.
17.3 CM.com Germany GmbH is entitled to engage third parties for the performance of the Agreement.
18.1 No liability is assumed on the part of CM.com Germany GmbH for the contents of external links. Content of linked pages is under the sole responsibility of its operator. Such links also do not signify that the external contents echo the view and/or opinion of CM.com Germany GmbH.
19.1 All offers from and Agreements with CM.com Germany GmbH and their performance, as well as these General Terms and Conditions are governed exclusively by German Federal Republic law.
19.2 Any disputes, including those which are only considered as such by one Party, resulting from or connected with the Agreement to which these General Terms and Conditions apply or the General Terms and Conditions themselves, will – notwithstanding the possibility of appeal – be submitted to the competent court in Frankfurt if the Client is classified as a merchant ("Kaufmann"), he concludes this Agreement as part of his professional activities, the Client is an institution of public law or a special fund under public law.
20.1 Notifications, including promises or (detailed) agreements from one to the other Party, that are important for performance of the Agreement, only bind the Parties if they are sent or confirmed by a person authorized thereto in writing.
20.2 Contact persons may only represent and bind Parties insofar as this concerns the performance of the Agreement. Contact persons are not authorized to amend the Agreement or these General Terms and Conditions.
20.3 Amendments or additions to the Agreement only apply if they are agreed in writing and have been signed by the persons authorized for this purpose on behalf of both Parties. Any amendment or addition will only apply to the relevant Agreement.
20.4 CM.com Germany GmbH is authorized to modify these Terms and Conditions at any time. CM will inform Client of any modifications. If Client doesn’t object in writing within a month from the date of sending of the modification notification, the modifications to the terms and conditions are deemed accepted by Client. If Client objects, the previous terms and conditions will still apply. However, CM then alternatively has the right to cancel the Agreement with Client by giving one (1) month written notice.
20.5 Failure by one of the Parties to demand compliance by the other Party with any obligation will not affect the right still to demand compliance, unless the Party in question has expressly agreed to the non-compliance in writing.
20.6 In the event that one or more of the conditions in this Agreement or these General Terms and Conditions is or becomes null and void, or is set aside by a court, the remaining conditions will continue to apply in full. The Parties will consult as regards the invalid provisions in order to agree, if possible, on a similar provision that is permitted by law.
20.7 The exclusion and limitations of the right to suspend or set-off in art. 4.4 and 10.2, the liability limitations in art. 13 and the choice of forum in article 19.2 are not applicable if the Client is a consumer ("Verbraucher").
20.8 These General Terms and Conditions are set out in both the English and German language but in case of conflict, the English version shall prevail.
21.1 In Part II of these Terms and Conditions, except where set forth otherwise, the following terms shall have the following meanings:
CM: the private limited liability company CM.com Germany GmbH (Handelsregister B des Amtsgericht Würzburg HRB 13092).
Data Protection Laws: the Data Protection Laws of the country in which Client is established and any Data Protection Laws applicable to Client and/or CM in connection with the Agreement.
Personal Data: any information relating to an identified or identifiable natural person (‘Data Subject’) that is Processed by CM in its role as Processor as part of providing the Service to Client under the Agreement. For the avoidance of doubt, Processing of personal data which is necessary for the operation of the electronic communication service and business contact information of Client shall not be subject to Part II of these Terms and Conditions.
Processing/to Process: any operation or set of operations which is performed on Personal Data, whether or not by automatic means, including collecting, accessing, storing, using, combining, transferring, disclosing or deleting of Personal Data.
Technical and Organizational Measures: measures to protect Personal Data against accidental or unlawful destruction or accidental loss, alternation, unauthorized disclosure or access and against all other unlawful forms of Processing.
Personal Data Breach: a breach of security leading to the accident or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.
The expressions such as, ‘Data Subject’, ‘Processor’, ‘Controller’, ‘data protection impact assessment’, etc. shall have the meaning ascribed to them in the Data Protection Laws.
21.2 References in Part II of these Terms and Conditions to the Data Protection Laws shall be replaced with or incorporate references to any laws replacing or amending those Data Protection Laws, and the equivalent terms defined in such laws, once in force and applicable.
21.3 Notwithstanding anything in Part II of these Terms and Conditions, CM will have the right to collect, extract, compile, synthesize and analyze non-personal identifiable data or information resulting from Client's use or operation of the Services including, by way of example and without limitation, information relating to volumes, frequencies, bounce rates, or any other information regarding communications (“Service Data”) Client, its End Users or recipients generate and send using the Services. To the extent any Service Data is collected or generated by CM such data will be solely owned by CM and may be used by CM for any lawful business purpose without a duty of accounting to Client, provided that such data is used only in an aggregated form, without directly identifying any person. For the avoidance of doubt, Part II of these Terms and Conditions will not apply to Service Data containing Personal Data.
21.4 In case of any conflict, the provisions of this Part II concerning Processing of Personal Data shall take precedence over the provisions of the Agreement and/or Part I. Where individual provisions of this Part II are invalid or unenforceable, the validity and enforceability of the other provisions shall not be affected.
22.1 Compliance
22.1.1 Client shall, in its use of the Service, Process Personal Data in accordance with the requirements of Data Protection Laws. For the avoidance of doubt, Client’s instructions for the Processing of Personal Data shall comply with Data Protection Laws. Client shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Client acquired Personal Data.
22.1.2 Client shall maintain accurate and complete records of the use of the Service under the Agreement during the term and as required under the Data Protection Laws. Upon reasonable written notice, Client shall provide information as requested and where required by CM, any Operator, regulator or other competent authority. Without limiting the generality of any other provision of the Agreement, prior to using the Service, Client shall obtain verifiable informed consent of the End Users or be able to provide confirmation of the lawful basis for Processing in accordance with applicable legislation and regulations, and shall maintain a record of each such consent and/or lawful basis.
23.1 Instructions
23.1.1 CM shall Process Personal Data in accordance with this Part II and the Agreement, and for the purposes and in the manner specified by Client from time to time in the Agreement and further instructions within the scope of the Agreement.
23.1.2 In case CM is required to Process Personal Data under mandatory law as specified in this Part II or the Agreement, CM shall for those purposes be considered an independent controller. If CM is required to Process Personal Data under mandatory law CM shall inform Client hereof in writing before Processing unless the law prohibits providing such information.
23.2 Technical and Organizational Measures
23.2.1 Taking into account the state of the art, the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, CM shall implement appropriate Technical and Organizational Measures (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Personal Data) to ensure a level of security appropriate to the risk. Up to date information regarding Technical and Organizational Measures can be found on CM.com/about-cm/security-compliance/.
23.2.2 CM shall test, assess and evaluate the effectiveness of Technical and Organizational Measures for ensuring the security of the Processing on an ongoing basis. CM shall continuously enhance and improve Technical and Organizational Measures.
23.3 Personnel requirements
CM ensures that persons authorized to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
23.4 Confidentiality
CM agrees that it shall maintain the Personal Data in confidence. In particular, CM agrees that it shall not disclose any Personal Data supplied to CM by, for, or on behalf of Client to any third party without Client's prior consent, except as foreseen and required for the performance of the Service under the Agreement or mandatory law.
23.5 Data Subject Rights
23.5.1 Where Client so instructs CM, CM shall transfer, correct, delete or block Personal Data if Client receives a request from a Data Subject to exercise the Data Subject's right of access, right to rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, object to the Processing, or its right not to be subject to an automated individual decision making (“Data Subject Request”). 23.5.2 CM shall promptly notify Client if CM receives a Data Subject Request. Taking into account the nature of the Processing, CM shall assist Client, for the fulfilment of Client’s obligation to respond to a Data Subject Request under Data Protection Laws. CM shall assist Client in responding to such Data Subject Request, to the extent CM is legally permitted to do so and the response to such Data Subject Request is required under Data Protection Laws. To the extent legally permitted, Client shall be responsible for any costs arising from CM’s provision of such assistance.
23.6 Assistance with Client’s compliance
CM shall provide to Client further assistance reasonably required to ensure compliance with Client's obligations under Data Protection Laws, including with respect to:
(a)data protection impact assessment, by providing such information and cooperation as Client may require for the purpose of assisting Client in carrying out a data protection impact assessment and periodic reviews to assess if the Processing of Personal Data is performed in compliance with the data protection impact assessment;
(b)prior consultation with a data protection supervisory authority regarding high risk Processing.
23.7 Compliance, information and audit
23.7.1 CM has obtained the third-party certifications set forth in the Security & Compliance section on the website of CM, which provides information on Technical and Organizational Measures and data security. Upon Client’s written request, and subject to the confidentiality obligations set forth in the Agreement, Processor shall make available to Client, that is not a competitor of CM (or Client’s independent, third-party auditor that is not a competitor of CM) a copy of CM’s then most recent third-party certifications and information regarding the IT architecture and security, as applicable and reasonably requested.
23.7.2 Client has the right to appoint an accredited external expert at most once per year to audit the procedures regarding the data Processing for Client. CM will cooperate with such audit upon a reasonable prior written notice of no less than ten working days. Client shall reimburse CM for any time expended by CM for any such audit at CM’s then-current professional services rates, which shall be made available to Client upon request. Before the commencement of any such audit, the Parties shall mutually agree upon the scope, timing, and duration of the audit in addition to the reimbursement rate for which Client shall be responsible.
23.7.3 CM is entitled to request that the external expert signs a confidentiality declaration in favor of CM. The confidentiality declaration shall contain the terms and conditions that are usual for this type of declaration. Any report or statement provided by the external expert shall be made available to CM. Client shall ensure that the audit hinders CM 's operations as little as possible.
23.8 Records
CM shall maintain complete, accurate and up to date records of Processing activities carried out on behalf of its Clients.
23.9 Affiliates and Sub-processors
23.9.1 Some or all of CM’s obligations under the Agreement may be performed by Affiliates of CM. For the purpose hereof an “Affiliate” means a legal entity directly or indirectly Controlling, Controlled by, or under common Control with CM, for so long as such Control lasts. "Control" shall exist through the direct or indirect ownership of more than 50% of the share capital of the legal entity or of more than 50% of the issued share capital entitling the holders to vote for the election of directors or persons performing similar functions. CM and its Affiliates have entered into intra-company arrangements, under which its Affiliates Processing Personal Data adopt safeguards consistent with those of CM. CM is responsible for compliance of its Affiliates' with this Agreement.
23.9.2 Client acknowledges and agrees that (a) CM’s Affiliates may be retained as Sub-processors; and (b) CM and CM’s Affiliates respectively may engage third-party Sub-processors in connection with the provision of the Services. Provided always CM or a CM Affiliate has entered into a written agreement with each Sub-processor containing data protection obligations not less protective than those in this Agreement with respect to the protection of Personal Data to the extent applicable to the nature of the Service provided by such Sub-processor. 23.9.3 CM shall be responsible for each of its Sub-processors to the same extent CM would be responsible if performing the services of each Sub-processor directly under the terms of the Agreement.
23.10 Breach Notification
In respect of a Personal Data Breach, CM shall:
(a) notify Client of a Personal Data Breach involving CM or a sub-contractor without undue delay (but in no event later than forty-eight hours after becoming aware of the Personal Data Breach).
(b) provide reasonable cooperation and assistance to Client in relation to any action to be taken in response to a Personal Data Breach under applicable Data Protection Laws, such as Art. 33(3) and 34(3) GDPR, including regarding any communication of the Personal Data Breach to the Data Subject and data protection authorities.
CM will promptly investigate a Personal Data Breach and take reasonable measures to identify its root cause(s) and prevent a recurrence. As information is collected or otherwise becomes available, unless prohibited by law, CM will provide Client with a description of the Personal Data Breach, the type of data that was the subject of the Personal Data Breach, and other information Client may reasonably request. The Parties agree to coordinate in good faith on developing the content of any related public statements or any required notices for the affected Data Subjects and/or the relevant data protection authorities.
CM shall Process and retain data, including Personal Data, in accordance with applicable law, regulations, including but not limited to national telecom legislation and Data Protection Laws. The data, including Personal Data, submitted to the platform of CM shall be Processed and stored in accordance with the CM’s data retention policy. The Personal Data shall be retained for no longer than is necessary for providing the Services under the Agreement, for the purposes as states in Part I and as far as required under applicable law. CM shall de-identify or depersonalize data into anonymized data after the applicable retention period. This results in data that includes no Personal Data or unique identifiers that could later be used to refer to the Personal Data to which the data was once associated.
25.1 Nature and Purpose of Processing
CM will Process Personal Data as necessary to perform the Services pursuant to the Agreement, as further specified in the Agreement, and as further instructed by Client in its use of the Services.
25.2 Categories of Data Subjects
Client may submit data to CM in using the Service, the content of which is determined and controlled by Client in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of Data Subjects:
• (Potential) customers (who are natural persons) of Client or its clients;
• Employees, contractors, advisors, freelancers or persons hired by (customers of) Client;
• Contact persons of Client’s prospects, customers and business partners;
• Client’s users authorized by Client to use the Services.
25.3 Type of Personal Data
Client may submit Personal Data to the Services, the extent of which is determined and controlled by Client in its sole discretion, and which may include, but is not limited to the following categories of Personal Data: First and last name, Contact information (company, address, email, phone), IP address.
25.4 Purposes of Processing
The Personal Data is Processed for the following purposes: Provision of the Services as detailed in the Agreement, handling complaints and disputes, providing information to emergency services, preventing fraud and criminal activities on CM’s platform.