Special Terms Datargo Monitor

1. Scope, Relationship to Other Documents and Order of Precedence

(1) These special terms (hereinafter “Special Terms Monitor”) apply exclusively to the use of the Datargo Monitor module and supplement the General Terms and Conditions of Datargo GmbH (hereinafter “Datargo”). They are directed exclusively at entrepreneurs within the meaning of Section 14 BGB (German Civil Code), at legal entities under public law and at special funds under public law.

(2) Insofar as these Special Terms Monitor and the General Terms and Conditions conflict in the context of Datargo Monitor, these Special Terms Monitor shall prevail. In all other respects the General Terms and Conditions, in particular the liability provision set out therein (Section 9 of the General Terms and Conditions), remain unaffected and apply on a supplementary basis. Any reference in these Special Terms Monitor to “the liability provision” refers to Section 9 of the General Terms and Conditions.

(3) The following order of precedence applies: individual agreement before Data Processing Agreement (AVV) before Service Level Agreement and these Special Terms Monitor before the General Terms and Conditions. In matters concerning the processing of personal data, the Data Processing Agreement prevails. Specific provisions for regulated customers are contained in the DORA Addendum for Financial Customers , which prevails over these Special Terms Monitor to the extent that it expressly makes deviating provisions for regulated customers.

2. Definitions

For these Special Terms Monitor, the following definitions apply in addition to the General Terms and Conditions:

3. Description of Services

(1) Datargo Monitor is a service for the automated observation of check targets determined by the customer. Datargo carries out the checks configured by the customer at the agreed check intervals, evaluates the results and provides the customer with status information, an incident history and reports.

(2) Datargo Monitor supports in particular the following types of checks. The specific scope of functions owed results from the selected plan and the description of services:

(3) The check intervals can be configured by the customer within the scope of the plan specifications. Datargo endeavours to comply with the configured intervals but does not owe execution to the precise second. For operational reasons, in particular for load balancing, the actual time of execution may deviate slightly from the configured time.

(4) Datargo may confirm events across several check regions before triggering an alert (multi-region confirmation, see Section 7). The evaluation is carried out in accordance with the procedures described in the respective plan and the threshold values chosen by the customer.

(5) Datargo continuously develops Datargo Monitor further. Datargo is entitled to adapt, replace or further develop individual functions, check types, evaluation procedures and interfaces, provided that the contractually owed scope of services is not thereby materially restricted and the legitimate interests of the customer are preserved. Datargo will announce material changes that are disadvantageous to the customer in text form with reasonable notice.

4. Auxiliary Tool Without Guarantee of Success or Completeness

(1) Datargo Monitor is an automated auxiliary tool to support the customer. What is owed is the careful performance of the agreed checks in accordance with the state of the art, but not a particular detection, reporting or other success.

(2) Datargo gives no guarantee that all incidents, disruptions or events will be detected, assessed or reported completely, correctly or in a timely manner. Undetected events (false negatives), delayed reports as well as incorrect reports and false alarms (false positives) are inherent to the system and cannot be entirely excluded even with careful operation. They depend, among other things, on the configuration by the customer, the nature of the monitored systems, the chosen threshold values and on circumstances outside the sphere of influence of Datargo.

(3) Claims on account of such events are excluded insofar as Datargo has observed the care owed. Liability in accordance with the liability provision of the General Terms and Conditions, in particular for intent, gross negligence, the breach of material contractual obligations as well as for damage arising from injury to life, body or health, from an assumed guarantee and under the ProdHaftG (German Product Liability Act), remains unaffected.

5. Delivery of Alerts via Third-Party Channels

(1) The delivery of alerts and notifications is carried out in part via the services of third parties, in particular via SMS and voice call providers (mobile network and telephony operators), push notification services and via email. Datargo has no influence on the availability, speed and actual delivery of these third-party channels.

(2) Datargo is not liable for delayed, missing, duplicate or erroneous deliveries that are based on circumstances within the sphere of third parties or of the customer, in particular on network, device or configuration problems, on overload or failure of a third-party channel, on spam, blocking or do-not-disturb filters, on roaming or delivery restrictions of individual network operators or on incorrect, incomplete or outdated contact data.

(3) The customer is obliged to,

a) set up and maintain several mutually independent notification channels, so that the failure of a single channel does not result in the absence of notification;

b) store an escalation chain with several recipients and substitution arrangements;

c) keep the stored contact data and channels up to date and test them regularly, but at least at the reasonable intervals to be determined by the customer, by means of test alerts.

(4) If the customer fails to take the measures pursuant to paragraph 3, this may be taken into account as contributory fault (Section 254 BGB) in the assessment of any claim for damages.

(5) Consequential damage arising from an undetected failure, a false alarm or the absence or delay of an alert is compensated exclusively in accordance with the liability provision of the General Terms and Conditions. In the case of simple negligence outside material contractual obligations, liability is excluded. Unlimited liability for intent and gross negligence, for damage arising from injury to life, body or health, from an assumed guarantee as well as under the ProdHaftG (German Product Liability Act) remains unaffected.

6. Customer’s Own Responsibility for Operation and Incident Response

(1) The use of Datargo Monitor does not replace the customer’s own responsible operation of the customer’s systems. The customer remains solely responsible for operation, security, data backup, redundancy, contingency planning, the response to incidents (incident response) as well as for the restoration of its systems.

(2) Datargo Monitor does not provide any response, intervention or restoration services on the monitored systems. The assessment of an alert, the initiation of countermeasures and the remedying of disruptions are incumbent solely on the customer, unless a separate individual agreement has been concluded in this respect.

(3) If the customer does not react to an alert, reacts too late or inadequately, or does not maintain its own protective, response and restoration measures, any damage arising therefrom or aggravated thereby is not attributable to Datargo. Contributory fault of the customer shall be taken into account.

(4) The customer ensures that it is entitled to monitor the respective check targets and that the performance of the checks by Datargo does not infringe any rights of third parties. The customer monitors exclusively its own systems or systems for the monitoring of which it holds the necessary authorisations.

7. Multi-Region Confirmation and Quorum

(1) The multi-region confirmation of events through a quorum of several check regions serves to reduce false alarms. It does not establish any assurance of a particular detection, accuracy or availability rate of the monitored systems.

(2) Datargo is entitled to adapt the number, location and composition of the check regions as well as the procedures for multi-region confirmation, insofar as this is necessary for operational, technical or legal reasons and the legitimate interests of the customer are preserved. A minimum number of check regions is only owed insofar as it is expressly assured in the plan or in an individual agreement.

8. Data of the Monitored Systems, Retention and Reports

(1) In the course of the checks, Datargo processes the data necessary for performance, in particular configuration data of the checks, measurement and result data, status histories, event and alert logs as well as the response data returned by the check target to the extent necessary for the evaluation.

(2) Insofar as personal data is processed via Datargo Monitor, the processing is governed by the Data Processing Agreement (AVV) . The customer ensures that the checks and check targets configured by it do not capture personal data without necessity and aligns its configuration with the principle of data minimisation.

(3) Datargo retains measurement, event and log data for the retention period described in the respective plan and makes status information, an incident history and reports available to the customer during the term of the contract. The standard retention period of the measurement and event data is 13 months per plan; extended retention for enterprise and regulated customers is to be agreed separately.

(4) Reports and incident histories are prepared to the best of knowledge on the basis of the collected measurement data. They document the checks carried out and the events detected, but do not establish any assurance going beyond Section 4 with regard to the completeness or correctness of the underlying detection.

(5) Upon request, Datargo makes the measurement, event and report data concerning the customer available to the customer in a common, machine-readable format. Details of the return at the end of the contract are governed by Section 12.

9. Security, Subprocessors and Audit Rights

(1) Datargo operates Datargo Monitor in EU data centres in Frankfurt am Main and maintains appropriate technical and organisational measures in accordance with the state of the art.

(2) Datargo is entitled to use subprocessors and third-party service providers for the provision of Datargo Monitor, in particular for the provision of check regions and for the delivery of alerts via third-party channels. Datargo selects these carefully and obligates them to an appropriate level of protection. The current register of the subprocessors and third-party channel providers used (in particular email, SMS and voice-call providers as well as providers of the check regions), with registered office and processing location, is set out in the sub-processor list ; insofar as personal data is processed in this context, it forms part of the DPA . The check regions and check nodes are operated in part by third-party providers worldwide; there, exclusively non-personal raw data of the server checks is processed, no personal data of the customers.

(3) Insofar as the customer is subject to regulatory supervision, Datargo grants the customer, an auditor commissioned by the customer as well as the competent supervisory authority the information, access, inspection and audit rights required under the applicable law in respect of the services provided for Datargo Monitor. Datargo cooperates in reasonable audits. Scope, procedure, notice periods, confidentiality and allocation of costs are governed by the DORA Addendum for Financial Customers or an individual agreement. Outside regulatory requirements, Datargo provides suitable evidence (such as current certificates and audit reports); on-site audits require a separate agreement.

10. Support with NIS2 and DORA Without Compliance Assurance

(1) Datargo Monitor can support the customer in meeting and demonstrating regulatory requirements, in particular in connection with the NIS2 Directive and its national implementation, Regulation (EU) 2022/2554 (DORA) as well as the standards of the ISO/IEC 27000 series, for example through status monitoring, reports and an incident history.

(2) Responsibility for compliance with these requirements remains solely with the customer and cannot, in regulatory terms, be transferred to Datargo. Datargo does not assure that the use of Datargo Monitor by itself meets the respective regulatory requirements.

(3) Insofar as Datargo acts under DORA as a third-party provider of information and communication technology for regulated customers, the provisions of the DORA Addendum for Financial Customers apply on a supplementary basis. The latter governs in particular the description of services and service level for critical or important functions, locations of service provision and data processing, subcontracting, incident support, cooperation in resilience testing, information, access and audit rights as well as termination and exit rights.

11. Distinction Between Service and Monitored Systems, Service Credits

(1) The availability agreed in the Service Level Agreement concerns exclusively the availability of Datargo Monitor itself, but not the availability, security or functionality of the systems monitored by the customer. Datargo does not owe the availability of the monitored systems.

(2) Excluded from the assured availability of the Platform is in particular the delivery of alerts via third-party channels (Section 5). The further exclusions from the calculation of availability result from the Service Level Agreement.

(3) In the event of a shortfall below the assured availability of the Platform, the service credits provided for in the Service Level Agreement are the customer’s conclusive remedy on account of the mere availability shortfall. Further-reaching claims for damages or reduction on account of the mere availability shortfall are excluded in this respect.

(4) Unaffected by paragraph 3 is mandatory liability, in particular for intent, gross negligence, the breach of material contractual obligations, damage arising from injury to life, body or health, claims from an assumed guarantee as well as under the ProdHaftG (German Product Liability Act). In the case of repeated significant shortfall below the assured availability, the customer is entitled to an extraordinary right of termination in accordance with the General Terms and Conditions and the Service Level Agreement.

12. Data Return and Deletion at the End of the Contract

(1) After termination of the contract for Datargo Monitor, Datargo makes the measurement, event and report data concerning the customer available to the customer, upon the customer’s request, within a reasonable period in a common, machine-readable format for return or export. The customer is required to arrange the export in good time before the end of the contract.

(2) After expiry of a reasonable transition period following the end of the contract, Datargo deletes the customer’s data, insofar as no statutory retention obligations conflict therewith. The transition and provisioning period for the data export after the end of the contract is 30 days; for enterprise and regulated customers an extended period may be agreed separately. Details concerning the deletion of personal data are governed by the Data Processing Agreement (AVV) .

(3) For regulated customers, the exit and transition provisions of the DORA Addendum for Financial Customers apply on a supplementary basis.

13. Liability

The liability of Datargo is governed conclusively by Section 9 of the General Terms and Conditions and the foregoing module-specific provisions. Unlimited liability for intent and gross negligence, for damage arising from injury to life, body or health, from an assumed guarantee as well as under the ProdHaftG (German Product Liability Act) remains unaffected by all of the foregoing limitations and exclusions.

Authoritative language version

This document is provided in German, English and French. The English and French versions are translations provided solely for convenience. The German version is authoritative and solely binding in the event of any dispute or any difference of interpretation or translation.