General Terms and Conditions (AGB)

Provider: Krone Baustein e.K., trading under the brand BauFin!app Eschenstieg 1 20259 Hamburg, Germany Represented by: Krzysztof Jerzy Buczyński, owner E-mail: support@baufin.app Data protection contact: datenschutz@baufin.app Tax number (Steuer-Nr.): 22/282/38532 VAT ID (USt-IdNr.): DE344558054 Commercial register: Amtsgericht Hamburg, HRA 127948

Version date: 2026-09-06

---

(1) These General Terms and Conditions ("AGB") apply to all contracts between BauFin!app (hereinafter the "Provider") and businesses within the meaning of §14 BGB (hereinafter the "Customer") concerning the use of the Software-as-a-Service solution BauFin!app and its associated modules.

(2) These AGB apply exclusively. The Provider does not recognise any terms of the Customer that conflict with or deviate from these AGB, unless the Provider has expressly agreed to their application in writing.

(3) The Provider offers its services exclusively to businesses within the meaning of §14 BGB. Consumer transactions within the meaning of §13 BGB are expressly excluded.

(4) Amendments to these AGB are communicated to the Customer in text form. The amendments become part of the contract if the Customer does not object to them in text form within six weeks of receipt of the notification. The Provider specifically points out this consequence in the notification.

---

(1) The subject matter of the contract is the provision of the software BauFin!app in its current version for use via the internet (Software as a Service) as well as the provision of storage space for the data generated by the Customer in the course of use.

(2) The specific scope of services results from the selected base package BauFin Fundament and the additional modules booked by the Customer (Employees, Subcontractors, Customer Portal, GPS Tracker, Datenexport Pro) as well as the service description valid at the time of conclusion of the contract at `https://baufin.app/pricing`.

(3) The software comprises in particular the following modules:

• bookkeeping and accounting (X-Rechnung, ZUGFeRD, Datev export),
• payroll,
• working time recording (compliant with BAG ruling 1 ABR 22/21),
• customer and order management,
• subcontractor management with construction withholding tax §48 EStG,
• dunning and receivables management,
• GoBD-compliant archiving,
• employee, subcontractor and customer portal,
• optional: GPS tracking of the vehicle fleet,
• optional: AI-supported guidance ("Spar-Check"),
• Included in the program without separate booking: Accountant Portal, Warehouse. The Concierge tools (§ 5) are included at no extra charge in the Customer Portal add-on module.

(4) The Provider is entitled to further develop, modify or extend the software, provided that this does not substantially restrict the contractually agreed scope of services. Substantial changes are announced in text form with a lead time of at least 30 days.

(5) NO TAX OR LEGAL ADVICE: The software supports the Customer in fulfilling tax and statutory obligations, but does not replace individual advice from tax advisors, lawyers, auditors or other expert advisors. This applies in particular to the "Spar-Check" module, which serves general information purposes only and does NOT constitute legal or tax advice within the meaning of the Tax Advisory Act (Steuerberatungsgesetz) or the Legal Services Act (Rechtsdienstleistungsgesetz).

---

(1) The presentation of the plans on the Provider's website does not constitute a binding offer, but an invitation to the Customer to submit an offer.

(2) By submitting the order in the ordering process, the Customer makes a binding offer to conclude a usage contract.

(3) The contract is concluded upon acceptance by the Provider. Acceptance takes place by confirmation in text form or by activation of the software.

(4) Upon conclusion of the contract, the Customer warrants that it is an entrepreneur within the meaning of §14 BGB. The Provider is entitled to request appropriate proof (e.g. trade registration, commercial register extract).

---

(1) The Provider makes the software available on its own servers or on the servers of its sub-processors (see AVV). The handover point is the router exit of the data centre.

(2) The Provider operates the software with the aim of the highest possible availability. A specific availability rate is not assured. For servers, network and power the Provider itself depends on third parties (see AVV, Annex 2) and does not promise higher availability than its own service providers promise to it.

(3) Maintenance windows are announced with reasonable advance notice in text form or in the software. Maintenance that cannot be postponed for compelling reasons (e.g. security updates) may be carried out by the Provider at short notice. Force majeure, network outages and cyber attacks by third parties are outside the Provider's responsibility.

(4) Support is handled on working days (Monday to Friday, excluding public holidays at the Provider's registered office). Fixed response or restoration times in hours are not assured. Credits or contractual penalties for unavailability are excluded; the Customer's statutory rights remain unaffected.

(5) Details on availability, maintenance and support are governed by Annex A (Availability and Support).

(6) The Provider is entitled to engage sub-processors within the meaning of Art. 28(2) GDPR. The current list of sub-processors forms part of the AVV (see § 9 and AVV Annex 2).

---

(1) Subject matter: The Provider makes tools available to the Customer in the company panel with which the Customer can handle data subject requests under Art. 15 to 22 GDPR itself. These include in particular: an overview of the requests received with deadline display, prepared response texts, the machine-readable data export and the documentation of the handling in the change log.

(2) No surcharge: These tools are part of the Customer Portal add-on module (§ 2). They are neither booked nor billed separately.

(3) The Customer remains the controller: The Customer is the controller within the meaning of Art. 4 No. 7 GDPR for the data of the persons it looks after. It answers the requests itself. The Provider does not answer any requests on behalf of the Customer, does not decide on their merits and does not represent the Customer vis-à-vis data subjects or supervisory authorities. A power of attorney is neither granted nor required.

(4) NO LEGAL SERVICE: The provision of software and text modules is not a legal service within the meaning of §2 RDG. The legal assessment of a request - for instance whether statutory retention obligations preclude an erasure - is a matter for the Customer; for complex questions the Provider recommends involving a lawyer specialising in data protection law.

(5) Deadlines: The one-month period under Art. 12(3) GDPR runs against the Customer. The software displays the remaining time and points out expiring deadlines; compliance with the deadline is owed by the Customer.

(6) Support in individual cases: At the express request of the Customer, the Provider supports the technical preparation of data (e.g. export, rectification in the system). Within the standard scope this support is covered by the remuneration under § 6. Exceptional effort - in particular more than 20 requests per month, disputes over identity or participation in court proceedings - is billed separately according to expenditure at standard market rates and requires a prior agreement in text form.

---

(1) The applicable prices for the base package BauFin Fundament and the additional modules result from the price list valid at the time of conclusion of the contract at `https://baufin.app/pricing`.

(2) All prices are inclusive of statutory value added tax at the current rate of 19 %. The amounts shown in the price list are gross prices; no further amount is added to the stated price.

(3) The fee is due monthly in advance and is payable within 7 days of invoicing. Payment is made via Revolut or PayPal (including card payment via these payment service providers).

(4) In the event of default in payment, the Provider is entitled:

• to charge default interest at the statutory rate under §288(2) BGB (9 percentage points above the base rate for businesses),
• in the event of default in payment of more than 14 days, to block use of the software, after a prior written reminder with a reasonable grace period (at least 7 days),
• in the event of default in payment of more than 30 days, to terminate the contract without notice.

(5) The Customer may only set off against claims of the Provider with undisputed or legally established counterclaims, or exercise a right of retention that is based on the same contractual relationship.

(6) The Provider is entitled to adjust the prices once per contract year. A price increase is communicated in text form 6 weeks before it takes effect. The Customer has the right to terminate the contract within this period with effect from the date of the price change.

(7) Free first month: The first month of software use is free of charge (trial month). The obligation to pay begins with the second month of use. During the free first month, the Customer may terminate the contract at any time in text form without giving reasons and without cost; in this case no payment obligations arise.

---

(1) The Customer is obliged:

• to use the software exclusively for its own purposes within its own business operations (in particular, no transfer to third parties except within the scope of its own client relationships),
• to keep the access data (username, password, 2FA devices) secure and to make them accessible only to authorised employees,
• to inform the Provider immediately if misuse of the access data is suspected,
• not to manipulate the software, reverse engineer it or circumvent security mechanisms,
• to maintain current master data in the software and to record changes without delay,
• to fulfil all data protection obligations incumbent upon it, in particular:
• fulfilment of the information obligations under Art. 13/14 GDPR,
• fulfilment of the obligation to keep a record of processing activities under Art. 30(1) GDPR (the program provides sample entries for this),
• fulfilment of the obligations as an employer under §26 BDSG (employee data protection),
• where applicable, conclusion of a works agreement under §87(1) No. 6 BetrVG when using GPS tracking,
• to fulfil, on its own responsibility, the statutory retention obligations under §147 AO, §257 HGB and §41 EStG (the software supports this through GoBD-compliant archiving).

(2) The Customer ensures that all employees who have access to the software are instructed in data protection and in the operation of the software before use begins.

(3) The Customer is liable for all activities carried out under its access data.

---

(1) The Provider warrants that the software conforms to the contractually agreed requirements during the agreed term and in particular fulfils the functions presented in the service description.

(2) The Customer's rights in respect of defects require that the Customer notifies defects in text form without delay after they become known.

(3) In the case of defects in the software that substantially impair its use, the Provider is entitled and obliged to remedy the defect. If the remedy fails despite two grace periods, the Customer may reduce the fee or terminate the contract with a reasonable notice period.

(4) The Provider remedies reported defects of the software with due care within the scope of support under § 4(4). There is no claim to credits or contractual penalties for unavailability; the statutory warranty rights remain unaffected.

---

(1) The Provider and the Customer agree that the processing of personal data by the Provider constitutes processing on behalf of a controller within the meaning of Art. 28 GDPR.

(2) The parties conclude a separate data processing agreement ("AVV") as an integral part of this contract. The AVV forms part of these AGB and becomes automatically effective upon conclusion of the contract.

(3) The obligations of both parties defined in the AVV continue to apply irrespective of the existence of these AGB for as long as data are stored with the Provider.

(4) Responsibility under data protection law: The Customer is the controller within the meaning of Art. 4 No. 7 GDPR. The Provider is the processor within the meaning of Art. 4 No. 8 GDPR. This allocation of roles is not adjusted.

(5) Any extensions are separate agreements that do not amend these AGB.

---

(1) Both parties undertake to treat as confidential all business secrets and confidential information of the other party that come to their knowledge within the scope of the contractual relationship and not to disclose them to third parties.

(2) The confidentiality obligation does not apply to information

• that was already known to the receiving party,
• that is or becomes publicly known without the receiving party being responsible for this,
• that was communicated to the receiving party by third parties without a confidentiality obligation,
• that must be disclosed by virtue of a statutory provision or an official order.

(3) The confidentiality obligation continues to apply for 5 years after the end of the contract.

---

(1) The Provider is liable without limitation:

• in cases of intent and gross negligence,
• in cases of culpable injury to life, body or health,
• under the provisions of the Product Liability Act (Produkthaftungsgesetz),
• to the extent of a guarantee assumed by the Provider.

(2) In the case of culpable breach of essential contractual obligations (cardinal obligations), the Provider is liable in principle. The amount of liability is limited to the damage typical for the contract and foreseeable. Essential contractual obligations are those whose fulfilment makes the contract possible in the first place and on whose observance the contractual partner regularly relies and may rely (e.g. provision of the software, protection of tenant data against unauthorised access).

(3) Otherwise, the Provider's liability is excluded.

(4) Maximum liability amount: The Provider's liability for damages arising from this contract is - unless intent, gross negligence, personal injury or product liability is involved - limited to the amount of the annual net fee in the respective year in which the damage occurs.

(5) Data loss: The Provider's liability for data loss is limited to the typical recovery effort that would have been incurred with regular and secure data backup by the Customer. The Customer is obliged to make regular backups of its data (export functions).

(6) GDPR liability: The liability of the parties under Art. 82 GDPR remains unaffected. The internal-relationship provision in the AVV takes precedence.

(7) IT liability insurance: The Provider maintains IT liability insurance with appropriate cover (sum insured at least EUR 1 million).

---

(1) Term: The contract is concluded for an indefinite period. There is no minimum term and no commitment to annual contracts.

(2) Ordinary termination: The contract may be terminated by either party at any time with a notice period of one month to the end of a calendar month in text form.

(3) Extraordinary termination: The right to extraordinary termination for good cause remains unaffected. Good cause includes in particular:

• repeated breach of essential contractual obligations after a warning,
• default in payment of more than 30 days,
• insolvency of a party,
• lasting disruption of the relationship of trust,
• significant and persistent unavailability of the software for which the Provider is responsible and which it fails to remedy despite the setting of a deadline.

(4) Form: Termination is made in text form (§126b BGB), e.g. by e-mail to `support@baufin.app`.

(5) Legal consequences of the end of the contract:

• the Customer immediately loses access to the software,
• the Provider keeps the Customer's data available for collection for 90 days (data export under AVV § 12),
• after expiry of the 90 days, the data are deleted in accordance with AVV § 12 (unless statutory retention obligations continue to apply, see AVV § 12(4)).

---

(1) The place of performance for all services under this contract is the Provider's registered office.

(2) The exclusive place of jurisdiction for all disputes arising from or in connection with this contract - to the extent permissible - is the Provider's registered office.

(3) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG) and the conflict-of-law rules of private international law.

---

(1) The first month from registration is free of charge (trial month); the obligation to pay begins with the second month of use. All functions including the additional modules are activated during the trial month; the Customer may terminate free of charge at any time during this period.

(2) After expiry of the trial period, access is restricted to read-only mode (no data changes possible). The Customer is informed by e-mail.

(3) If no payment details are provided within 90 days of expiry of the trial period, all data are irrevocably deleted. The Customer is informed by e-mail 14 and 7 days before deletion.

---

(1) The Provider offers "Datenexport Pro" as an optional, paid additional service. This service comprises the daily automatic export of all of the Customer's business data in a machine-readable format.

(2) The export files are stored in encrypted form with an external storage service provider (data centre Amsterdam, EU). The retention period is 30 days. In the user panel, the exports of the last 7 days are available for download.

(3) The download link is valid for 72 hours and limited to a maximum of 5 downloads. Every download is logged for audit purposes.

(4) The Provider guarantees an export availability of 99.5 % per calendar month. Scheduled maintenance work is excluded from this and is announced at least 48 hours in advance.

(5) The Recovery Point Objective (RPO) is 24 hours. In the event of a disruption, therefore, at most one day's data may be missing from the export.

(6) Details on the availability and quality of the service are set out in the Service Level Agreement (SLA) at `baufin.app/sla`.

---

(1) The Customer is obliged to use the data backup options provided by the Provider regularly and to save copies of its data on its own storage media — at least once a week.

(2) BauFin!app provides two options for this: a) the free "Data backup" function (Settings → Data backup), which allows a manual download at any time; b) the optional "Datenexport Pro" service under § 15.

(3) Users of the "Datenexport Pro" service are obliged to download the delivered export files regularly — at least once a week.

(4) If the Customer fails to back up its data regularly, any damage resulting from this is to be taken into account as contributory negligence of the Customer within the scope of § 254 BGB. In this case, the Provider's liability is limited to the recovery effort that would have been necessary with proper data backup by the Customer.

---

(1) The Provider is liable without limitation for damages arising from injury to life, body or health as well as for damages based on intentional or grossly negligent conduct.

(2) In the case of breach of essential contractual obligations (cardinal obligations) through slight negligence, liability is limited to the damage typical for the contract and foreseeable.

(3) Any further liability for slight negligence is excluded.

(4) The Provider holds IT liability insurance. Details on request.

---

(1) Severability clause: Should individual provisions of these AGB be or become wholly or partially invalid, this shall not affect the validity of the remaining provisions. The invalid provision shall be replaced by a valid one that comes economically closest to the meaning and purpose of the invalid provision.

(2) Amendments: Amendments and supplements to these AGB require text form. This also applies to any amendment of this text form requirement.

(3) Precedence of the AVV: In the event of contradictions between these AGB and the AVV, the provisions of the AVV take precedence insofar as data protection matters are concerned.

(4) Annexes: The following annexes are an integral part of these AGB:

• Annex A: Availability and Support
• Incorporated by reference: AVV - Data Processing Agreement (Document 02)

(5) Notifications: Notifications are made in text form to the e-mail addresses recorded in the contract. The Customer undertakes to notify changes to its e-mail address without delay.

---

The Provider operates the software with the aim of the highest possible availability. A specific availability rate is neither assured nor billed.

The reason is not reticence but actual dependency: servers, network and power are provided by third parties (see AVV, Annex 2). The Provider cannot promise higher availability than its own service providers promise to it, and therefore promises none.

Working days are Monday to Friday, excluding public holidays at the Provider's registered office. Fixed response or restoration times in hours are not assured.

Credits, contractual penalties or liquidated damages for unavailability are excluded. The Customer's statutory rights - in particular warranty and the right to extraordinary termination for good cause under § 12 - remain unaffected.

The Customer reports faults by e-mail to `support@baufin.app` or as a request in the company panel. Every report receives a case number.