General Terms and Conditions
for Software Development and IT Services (B2B)
of HERTON Digital GmbH, Vorlaufstraße 5/1, 1010 Vienna, Austria, company register no. FN 191435y (Commercial Court of Vienna)
Version: September 2026
1. Scope of Application
1.1 These General Terms and Conditions (“GTC”) apply to all contracts between HERTON Digital GmbH (“Contractor”) and entrepreneurs within the meaning of Section 1 of the Austrian Commercial Code (UGB) (“Client”) concerning the development, adaptation, maintenance and delivery of software as well as related consulting and other IT services. They do not apply to consumers within the meaning of the Austrian Consumer Protection Act (KSchG).
1.2 These GTC become part of the contract only if they were demonstrably provided to the Client prior to conclusion of the contract and the Client agreed to their application. Deviating, conflicting or supplementary purchasing or other terms and conditions of the Client are hereby excluded and do not become part of the contract even if the Contractor does not separately object to them.
1.3 Offers made by the Contractor are non-binding; a contract is only formed upon written order confirmation by the Contractor (which may also be sent by e-mail) or upon actual commencement of performance.
1.4 Individual agreements made in writing take precedence over these GTC.
2. Subject Matter of the Contract and Scope of Services
2.1 The subject matter of an order may in particular include: the creation of custom software, the adaptation and maintenance of existing software, consulting and analysis services, migration support, as well as the granting of usage rights to standard software/library programs.
2.2 Only the functions, interfaces and characteristics expressly described in the respective offer, functional specification or Statement of Work (“Service Description”) are binding.
2.3 The Contractor owes the production of a functional work in accordance with the state of the art recognized at the time of completion, but does not owe any particular economic success for the Client.
2.4 Changes to the scope of services (Change Requests) require written form as well as a separate agreement on additional effort and any extension of deadlines.
3. Client's Duties to Cooperate and Responsibilities
3.1 The Client shall provide the Contractor, in a timely and complete manner and at its own expense, with all necessary information, access, decisions, as well as practical test data and testing facilities.
3.2 Unless expressly agreed otherwise, the Client shall be solely responsible for: the operation, configuration and security of the target environment (servers, cloud services, network); the granting and management of access rights and credentials; the installation of security updates and patches after handover; data backup; as well as compliance with industry- or product-specific regulatory requirements, including data-protection-related organizational measures (GDPR), NIS2, PCI-DSS and — insofar as health data is processed — the requirements for special categories of personal data (Art. 9 GDPR).
3.3 If the provision of services is delayed due to a breach of the Client’s duties to cooperate, agreed deadlines shall be postponed accordingly; additional effort shall be remunerated separately. Any resulting delivery delays are not attributable to the Contractor and do not constitute default.
4. Testing, Acceptance
4.1 Individually created software or program modifications require acceptance of the affected program package no later than four weeks after provision. Acceptance must be confirmed in writing.
4.2 If the Client allows this period to lapse without declaring acceptance or without raising sufficiently documented, material defects, the service shall be deemed accepted. Use of the software in live/production operation shall in any case be deemed acceptance. Upon acceptance, risk for the accepted parts passes to the Client.
4.3 The Client is not entitled to refuse acceptance on account of immaterial defects.
5. Fees, Prices and Payment Terms
5.1 The fee agreed in the offer (fixed fee or time-and-materials fee) applies, plus value-added tax at the applicable rate.
5.2 Unless otherwise agreed, invoices are due within 14 days of invoicing, without deduction and free of charges. For orders comprising multiple partial services, the Contractor is entitled to issue partial invoices after delivery of each unit.
5.3 Compliance with payment deadlines constitutes a material condition for the provision of services. In the event of default in payment, the Contractor is entitled to suspend ongoing work, withhold the provision of services until outstanding claims have been settled, and/or withdraw from the contract; this is without prejudice to default interest pursuant to Section 456 UGB, dunning fees and compensation for further damage caused by default. In the case of agreed installment payments, default on two installments shall result in the loss of the term/benefit for all outstanding claims (acceleration).
5.4 The Client is not entitled to withhold payments or set them off against alleged defects, warranty or guarantee claims, unless the counterclaim has been judicially established or acknowledged in writing by the Contractor.
5.5 If, under the order, physical items (e.g., data carriers, hardware) are to be transferred into the ownership of the Client, they shall remain the property of the Contractor until full payment of all claims arising from the business relationship.
5.6 Cancellation of a placed order by the Client is only possible with the written consent of the Contractor. If the Contractor consents, it is entitled, in addition to the services already rendered and costs incurred, to a cancellation fee amounting to 30% of the not-yet-invoiced order value of the overall project.
6. Copyright and Usage Rights
6.1 Subject to any deviating agreement in the offer and upon full payment of the agreed fee, the Contractor grants the Client a non-exclusive, non-transferable, non-sublicensable right of use to the individually developed software, limited in time and place to the contractual purpose. All rights beyond this remain with the Contractor.
6.2 If an exclusive right of use has been expressly agreed, this does not apply to program components created by independent third parties and integrated by the Contractor (e.g., open-source components, third-party libraries, frameworks); in this respect, the respective license terms of the rights holders apply.
6.3 The Client’s participation in the creation of the software does not give rise to any rights beyond the contractually agreed use; no joint authorship of the Client arises.
6.4 The source code and program documentation will only be handed over upon express separate agreement and against separate remuneration; in any case, handover requires full payment of all outstanding claims.
6.5 Any system passwords for individually created services will only be disclosed to the Client if (a) there is no ongoing maintenance or support contract for the affected component, (b) all of the Client’s payment obligations have been fulfilled, and (c) the Client provides a corresponding waiver of warranty for independent use.
7. Warranty
7.1 The Contractor warrants that, at the time of acceptance, the software substantially corresponds to the agreed Service Description and fulfills the functions described therein, provided it is operated in the contractually agreed environment.
7.2 Remedy of defects is subject to the Client reporting the defect, sufficiently documented and specified, within the period of Section 377 UGB (applied by analogy), providing all documents and cooperation necessary for investigation, and to neither the Client nor any third party attributable to the Client having made changes to the software without the Contractor’s consent.
7.3 The warranty period is six months from acceptance. Rectification (repair) shall in any case take priority over price reduction or contract rescission; these remedies are only available after the fruitless expiry of a reasonable additional period set for rectification. The statutory presumption of defectiveness (Section 924 of the Austrian Civil Code, ABGB) and the defense against payment claims pursuant to Section 933(3) ABGB are excluded to the extent legally permissible.
7.4 The warranty does not apply to programs that are subsequently modified by the Client itself, its employees, or third parties not engaged by the Contractor; the same applies to defects attributable to an operating environment, third-party software, or improper use for which the Client is responsible.
7.5 An obligation to update the software (Section 7 of the Warranty of Goods Act (VGG) in conjunction with Section 1(3) VGG) exists only insofar as this is separately and expressly agreed; otherwise, this obligation is excluded to the extent legally permissible.
8. Liability
8.1 The Contractor shall be liable for damages demonstrably caused by it, or by vicarious agents engaged by it, only in cases of gross negligence or intent. The Contractor’s liability is unlimited for damages arising from injury to life, body, or health, and for damages under the Austrian Product Liability Act (Produkthaftungsgesetz, PHG), to the extent that act mandatorily applies.
8.2 Direct damages are compensable. Indirect damages — in particular loss of profit, foregone savings, business interruption, other consequential damages, and claims by third parties — are, to the extent legally permissible, not covered by the Contractor’s liability. For loss of data, Section 8.3 applies.
8.3 For loss of data, the Contractor — to the extent it is liable on the merits — shall be liable solely for the effort that would have been required to restore the data had the Client performed proper, regular data backups in accordance with the state of the art. Where data backup has been expressly agreed as a separate contractual service of the Contractor, the Contractor’s liability for loss of data shall, by way of exception, be limited to a maximum of 10% of the order value per claim and a maximum of EUR 15,000 in total.
8.4 Claims for damages by the Client against the Contractor shall, to the extent legally permissible, be time-barred one year after the claimant becomes aware of the damage and the party liable, and in any event three years after the event giving rise to the damage. This shall not affect claims arising from intentional or grossly negligent conduct, claims arising from injury to life, body, or health, or claims arising from mandatory statutory liability provisions.
8.5 The Contractor is entitled to engage third parties and subcontractors to perform its services; this shall not affect the Contractor’s responsibility toward the Client for the proper performance of its contractual obligations. Where warranty or liability claims arise against such third parties, the Contractor shall assign these claims to the Client; in such a case, the Client shall pursue these third parties in the first instance. Any statutory or contractual recourse claims of the Contractor against the engaged third parties shall remain unaffected.
9. IT Security and Allocation of Responsibility
9.1 IT security is a shared responsibility. The Contractor develops and provides its services within the agreed scope applying the secure coding practices recognized and customary in the industry at the time the services are rendered, and taking into account the security measures expressly agreed in the offer (e.g., input validation, encryption as specified, authentication mechanisms). Absolute security of the software or of the systems operated by the Client against vulnerabilities, cyberattacks, unauthorized access, data loss or other security incidents cannot be guaranteed and is not owed.
9.2 Unless expressly provided for and remunerated in the offer, a Service Description, a Service Level Agreement, or another separate agreement, the following services in particular are not part of the contract: penetration tests and red-team tests; security audits or certifications; ongoing vulnerability and threat monitoring, including of third-party components; hardening, operation and security of the Client’s infrastructure; Managed Detection and Response (MDR) or comparable security services; as well as ongoing security updates and the remediation of security vulnerabilities after handover, insofar as maintenance, update or support services have not been expressly agreed for this purpose.
9.3 For damages arising from security incidents (e.g., security vulnerabilities, cyberattacks, unauthorized access), the Contractor shall be liable in accordance with Section 8, and only to the extent the damage is attributable to a grossly negligent or intentional breach by the Contractor of agreed security requirements. This presupposes, in particular, that the damage is not attributable to the following circumstances within the sphere of the Client or third parties: systems, infrastructure, or configurations within the Client’s sphere pursuant to Section 3.2; modifications to the software or systems by the Client or third parties engaged by the Client; the use of outdated, unsupported, or insecure systems; the failure to install updates and security patches that were provided or could reasonably be expected to be installed; security vulnerabilities in third-party components that could not reasonably have been identified or avoided by the Contractor exercising customary and appropriate industry care; or zero-day vulnerabilities or attacks by third parties that could not have been prevented or avoided through customary and appropriate security measures.
9.4 The Client is obliged to implement security updates, patches or other security-relevant measures provided or communicated by the Contractor within a reasonable and acceptable period. If the Client fails to do so, the Contractor’s liability for resulting damages is excluded to the extent the damage results from the omitted or delayed implementation.
9.5 Unless the Contractor has been expressly engaged with the operation, maintenance, monitoring or security of the Client’s IT systems, data backup, backup management, access and permission management, updating of the systems used, and securing the infrastructure are the sole responsibility of the Client pursuant to Section 3.2.
10. Confidentiality and Data Protection
10.1 Both parties undertake to keep confidential all confidential information of the other party that becomes known in the course of the cooperation and to use it only for the performance of the contract; subcontractors affiliated with the Contractor are not considered third parties, provided they are subject to an equivalent confidentiality obligation.
10.2 Insofar as the Contractor processes personal data on behalf of the Client — in particular in digital health projects involving health data pursuant to Art. 9 GDPR — the parties shall enter into a separate data processing agreement pursuant to Art. 28 GDPR before processing begins.
11. Loyalty / Non-Solicitation
11.1 The contracting parties undertake to mutual loyalty and, during the term of the contract and for 12 months thereafter, shall neither poach nor employ — including via third parties — employees who participated in the execution of the orders. The party in breach of this obligation shall pay liquidated damages in the amount of one annual gross salary of the employee concerned.
12. Term and Termination
12.1 Contracts for work end upon acceptance of the agreed service. Continuing obligations (e.g., maintenance, further development) run for an indefinite period and may be terminated in writing by either party with three months’ notice to the end of a month.
12.2 The right to extraordinary termination for good cause remains unaffected.
13. Accessibility
13.1 An accessible design of the service, in particular within the meaning of the Austrian Accessibility Act (BaFG), the BGStG, or the WZG, is not part of the contract unless separately and expressly commissioned. In this case, verification of the service’s compliance with the relevant statutory provisions is the responsibility of the Client; likewise, the Client must review the legal admissibility of any content it provides.
14. Final Provisions
14.1 Austrian law applies, excluding its conflict-of-laws rules and the UN Convention on Contracts for the International Sale of Goods (CISG).
14.2 To the extent legally permissible, the courts having subject-matter jurisdiction at the Contractor’s registered seat in Vienna are agreed as the venue for all disputes arising from or in connection with this contract.
14.3 In the event of disputes that cannot be settled amicably, the parties may, by mutual agreement, engage a registered commercial mediator (pursuant to the Austrian Mediation Act, ZivMediatG) from the list maintained by the Federal Ministry of Justice before initiating legal proceedings.
14.4 Should any provision of these GTC be or become invalid, the validity of the remaining provisions shall remain unaffected; the parties undertake to replace the invalid provision with a valid one that comes closest to the economic purpose of the invalid provision.
This English translation is provided for convenience and information purposes only and does not constitute a legally binding version of these General Terms and Conditions. Only the original German-language version is legally binding. In the event of any discrepancy or inconsistency between this English translation and the German original, the German original shall prevail.