Managed Services Agreement

The Buffalo Company

Version: 1.0
Document date: 12 November 2026
Provider: Obed Klein, trading as The Buffalo Company
Legal form: Einzelunternehmen
Customer: As identified in the applicable Service Confirmation
Effective date: Date of acceptance of the applicable Service Confirmation

---

1. Parties

1.1. This Managed Services Agreement ("Agreement") is entered into between:

Provider:
Obed Klein, trading as The Buffalo Company
Steingruberstr. 5
90579 Langenzenn
Germany
Email: hello@thebuffalocompany.com
Website: https://thebuffalocompany.com

and the customer identified in the applicable Service Confirmation ("Customer").

1.2. The Buffalo Company is the trading name of Obed Klein, operating as a German sole proprietorship (Einzelunternehmen). It is not a separate legal entity.

1.3. The Provider and Customer are individually referred to as a "Party" and collectively as the "Parties".

2. Purpose and contractual documents

2.1. This Agreement governs the provision of managed technology services by the Provider, including website monitoring, security monitoring, website maintenance, managed websites, managed infrastructure, and backup services where commissioned.

2.2. The Agreement consists of the following documents, where applicable:

• This Managed Services Agreement.
• The accepted Service Confirmation, including its scope, fees and customer-specific conditions.
• Applicable service-specific schedules, including the Backup and Restoration Schedule and Managed Infrastructure Schedule.
• The Data Processing Agreement ("DPA"), where applicable.
• The Technical and Organisational Measures ("TOMs"), where applicable.
• The applicable Subprocessor Schedule.
• Any subsequent written amendments accepted by both Parties.

2.3. The following order of precedence applies in the event of a conflict:

a. Mandatory statutory provisions prevail over all contractual documents.

b. An accepted written amendment prevails over the documents it expressly amends.

c. The DPA prevails over this Agreement and other contractual documents concerning the processing of personal data.

d. The Service Confirmation prevails over this Agreement concerning the specific services, scope, fees, exclusions, special conditions and agreed liability caps for that Customer.

e. Service-specific schedules govern the technical and operational details of the services to which they relate, provided they do not conflict with mandatory provisions or the DPA.

f. This Agreement governs all remaining general contractual matters.

2.4. A Service Confirmation does not override mandatory legal protections or provisions of the DPA merely by describing a different commercial or technical arrangement.

2.5. The Service Confirmation identifies the language governing the contract. The English and German versions are intended to be substantively equivalent. If both versions are supplied, the selected version governs and the other is provided for reference. If no language is expressly selected, the language of the accepted Service Confirmation determines the contract language.

3. Services

3.1. The Provider supplies only the services expressly commissioned in the applicable Service Confirmation.

3.2. Services may include:

• Website availability monitoring.
• Standalone security monitoring.
• Website maintenance and corrective technical support.
• Managed website services.
• Managed infrastructure services.
• Backup and restoration services.
• Other individually agreed technical services.

3.3. The Service Confirmation identifies the selected plan, covered systems, service scope, applicable limits, fees, exclusions and any additional conditions.

3.4. Services not expressly included in the Service Confirmation are outside the agreed scope and may be separately quoted.

3.5. The Provider may use appropriate software, monitoring tools, infrastructure and technical methods to perform the services. The Provider may replace or update these tools where reasonably necessary, provided the agreed service obligations are maintained.

3.6. The Provider does not undertake to provide services outside its agreed scope merely because the Provider has technical access to a Customer system.

4. Service plans, scope and allowances

4.1. The following standard monthly plans are available:

Service plan	Monthly fee
Website Monitoring	€39
Standalone Security Monitoring	€59
Website Care	€189
Managed Website	€229

4.2. The applicable plan and any additional services must be identified in the Service Confirmation.

4.3. Website availability monitoring is included in Website Monitoring, Website Care and Managed Website. Unless otherwise agreed, availability monitoring covers up to five URLs per managed website.

4.4. The five-URL limit does not apply to Standalone Security Monitoring.

4.5. Standalone Security Monitoring is a separate service and does not, by itself, include website maintenance, general technical support or infrastructure administration.

4.6. Human Alert Review is included in all four standard plans, subject to a cumulative allowance of 15 minutes per billing month. Where multiple relevant services are provided for the same managed website, the allowance is shared rather than multiplied.

4.7. Human Alert Review covers limited review and initial assessment of monitoring alerts. It does not constitute unlimited incident response, forensic investigation, malware removal or comprehensive remediation.

4.8. Website Care and Managed Website include up to 60 minutes of corrective technical support per managed website per billing month. This allowance applies to qualifying corrective technical work within the agreed service scope.

4.9. Routine maintenance and corrections already included in the applicable service do not consume the corrective technical support allowance.

4.10. Unused monthly allowances expire at the end of the relevant billing month and do not carry forward.

4.11. Reporting is included only in Website Care and Managed Website. On request, the Customer may receive one reasonable summary of recorded work and significant incidents per managed website per calendar month.

4.12. Additional routine technical work is charged at €75 per hour, calculated in 15-minute increments, subject to the Customer's prior approval.

4.13. Extensive investigation, incident response, forensic analysis, recovery, migration, substantial remediation and other work outside the agreed scope require a separate quotation or written approval.

4.14. Third-party licences, exceptional external costs and other expenses required for the agreed service may be charged separately where disclosed and approved by the Customer before they are incurred, where reasonably practicable.

5. Support and communication

5.1. The Provider's standard support hours are Monday to Friday, 09:00 to 17:00 German local time (CET or CEST, as applicable), excluding German public holidays.

5.2. The primary support contact is:

Email: hello@thebuffalocompany.com

5.3. For Website Care, Managed Website and ongoing Managed Infrastructure services, the Provider aims to provide an initial response:

• Urgent matters: within four business hours.
• Routine matters: within one business day.

5.4. These are initial response targets, not guaranteed resolution times or guaranteed restoration times.

5.5. The response period runs only during the Provider's standard support hours. Time outside those hours does not count towards the stated response targets.

5.6. Monitoring-only plans include the agreed alert review and notification obligations, but do not include general technical support or a guaranteed technical response to every monitoring event.

5.7. The Provider does not provide 24/7 support or continuous emergency response unless expressly agreed in writing.

5.8. The Customer must keep its contact details and designated notification contacts reasonably up to date.

6. Monitoring, alerts and maintenance

6.1. The Provider performs monitoring and maintenance only to the extent included in the commissioned services.

6.2. Availability monitoring is generally performed at five-minute intervals. The recorded information may include the monitored hostname or URL, check result, timestamp, response time and HTTP status code.

6.3. Unless otherwise agreed, availability monitoring history is retained for 30 days.

6.4. A significant availability incident is generally identified where a monitored service remains unavailable for 20 consecutive minutes. The Provider may notify the Customer earlier where repeated failures indicate a persistent issue.

6.5. Serious security alerts or unexpected file-integrity changes may also justify earlier notification.

6.6. Automated monitoring events are not necessarily individually reviewed or immediately communicated. The Provider reviews alerts within the scope and allowances of the applicable service.

6.7. The Provider may provide a Customer-specific status page. Such pages are informational, may be publicly accessible to anyone with the relevant URL, and are not confidential or access-controlled unless expressly agreed otherwise.

6.8. A status page may display the relevant service name, current availability, recent uptime history and incident or recovery history, where supported by the monitoring platform. It does not provide access to administrative functions, credentials or other customers' monitoring information.

6.9. Status pages reflect recorded monitoring results and may be delayed, incomplete or temporarily unavailable. They do not constitute a guarantee of service availability.

6.10. The Provider may change the monitoring tools or platform while maintaining the agreed service obligations. The Customer is not entitled to direct administrative access to the Provider's monitoring platform.

6.11. The Provider may perform routine maintenance without individual advance notice where no material disruption is reasonably expected.

6.12. Planned maintenance likely to cause material disruption will be notified in advance where reasonably possible.

6.13. Emergency maintenance may be performed without advance notice where reasonably necessary to protect or restore the relevant environment. The Provider will notify the Customer as soon as reasonably practicable.

6.14. The Provider may identify unsupported or end-of-life software and components, explain associated concerns and recommend upgrades or replacement. Substantial upgrades, migrations or replacements are separately scoped and quoted.

6.15. The Provider is not required to maintain components that cannot reasonably or safely be maintained.

7. Security monitoring and file integrity

7.1. Where file-integrity monitoring is included, the Provider may use its proprietary file-integrity scanner to detect unexpected changes to monitored files.

7.2. The scanner is designed to collect file metadata rather than routinely access file contents or database contents.

7.3. Metadata may include relative file paths, cryptographic hashes, file sizes, timestamps, change types, relevant permissions, baseline versions and scan results.

7.4. Standard file-integrity scans are performed daily, with additional scans after significant authorised changes where technically feasible.

7.5. An approved integrity baseline is maintained while the relevant service remains active. Unexpected changes are not automatically accepted as a new baseline.

7.6. Baseline updates are performed following authorised changes or other appropriate confirmation.

7.7. Routine scan summaries are generally retained for 30 days. Individual detected-change records are generally retained for 90 days.

7.8. File paths and other metadata may themselves reveal personal or confidential information and will be handled accordingly.

7.9. The scanner is not intended to collect source-code copies, database contents, visitor information, Customer records, passwords, access tokens or credentials as part of routine scanning.

7.10. The Provider's proprietary scanner and associated software remain the Provider's intellectual property.

8. Backup and restoration services

8.1. Backup services are provided only where expressly included in the Service Confirmation or a separate accepted backup arrangement.

8.2. Backup services may be provided:

a. As part of an individually scoped Managed Infrastructure engagement; or

b. As a standalone recurring service for a Customer-managed website, server or other supported system, without the Provider undertaking ongoing administration of that system.

8.3. A standalone backup service is subject to a technical compatibility and risk assessment before activation. The Provider may decline a system that cannot reasonably or safely be backed up or restored.

8.4. A standalone backup service does not imply that the Provider is responsible for administering, securing, updating or monitoring the underlying system.

8.5. The Customer remains responsible for the underlying system, its availability, required access and changes made by the Customer or other providers.

8.6. The applicable Backup and Restoration Schedule and Service Confirmation define the systems and data covered, backup frequency, retention, capacity, storage configuration, restoration assistance and testing obligations.

8.7. Unless otherwise agreed, the standard starting policy is:

• Website files and databases: daily backups.
• Daily retention: seven days.
• Weekly retention: four weeks.
• Monthly retention: three months.
• Configuration backups: after significant changes and scheduled copies as agreed.

8.8. Each commissioned backup system is subject to restoration testing at onboarding and quarterly thereafter. Testing is performed in an appropriate test environment or location and is not intended to overwrite production data.

8.9. Backup capacity tiers and applicable fees are identified in the Service Confirmation. Capacity is measured by the actual storage consumed by retained backup copies, including daily, weekly and monthly copies, rather than solely by the size of the live system.

8.10. The Provider will notify the Customer when storage usage approaches the agreed capacity. Any increase in recurring charges requires the Customer's approval. If no increase is approved, the Parties will agree an appropriate adjustment to the backup scope or retention configuration.

8.11. Where technically supported, the Provider uses automated detection of failed or incomplete backup jobs. The Provider reviews material failures, notifies the Customer and makes reasonable efforts to resolve them within the agreed scope.

8.12. The Provider does not guarantee that every backup job will succeed or that every item can always be restored.

8.13. Backup data will be stored in an Azure region in Germany. The actual region and storage redundancy configuration will be identified in the Service Confirmation before activation.

8.14. Zone-Redundant Storage (ZRS) is preferred where available and suitable in the selected German region. Locally Redundant Storage (LRS) may be used where ZRS is unavailable or unsuitable. Geo-redundant replication will not be used unless the location of all replicated backup copies has been verified and remains within Germany.

8.15. The Parties do not agree to guaranteed Recovery Point Objectives (RPOs) or Recovery Time Objectives (RTOs) under the standard backup service. Recovery points depend on successful backup completion and the agreed backup frequency. Restoration time depends on the data volume, system complexity, availability of infrastructure and nature of the restoration.

8.16. Routine restoration assistance is limited to 30 minutes per managed system per billing month, covering technically straightforward restoration of specified files, folders or databases from an available usable restore point.

8.17. Unused restoration assistance expires monthly and does not carry forward. Additional routine restoration work is charged at €75 per hour in 15-minute increments, subject to prior approval.

8.18. Full server recovery, disaster recovery, investigation of corrupted systems, application troubleshooting, reconstruction and migration are separately scoped and quoted.

8.19. Onboarding and quarterly restoration tests do not consume the routine restoration allowance.

8.20. Before performing potentially destructive or high-risk work within the Provider's control, the Provider will verify that an appropriate backup or snapshot exists where technically possible. If no usable backup is available, the Provider will inform the Customer and obtain approval before proceeding, where reasonably practicable.

8.21. On termination, scheduled backups stop on the agreed service end date. Existing backup data remains available for up to 30 days after the effective termination date for a final restoration or export request, subject to technical availability and the agreed scope.

8.22. After that period, active backup data may be deleted, subject to technical feasibility and applicable legal retention requirements. Residual copies expire according to the underlying storage and deletion mechanisms. Extended retention requires express written agreement and may incur additional charges.

8.23. The Provider is not responsible for data that was irrecoverably lost before the Provider's involvement, was never successfully backed up, or was outside the agreed backup scope.

9. Managed Infrastructure

9.1. Managed Infrastructure services are individually scoped and may include VPS administration, Linux system administration, hardening, monitoring, backups, deployments, migrations and related technical work.

9.2. Managed Infrastructure is not an unlimited fixed-price technical support service.

9.3. Before every new ongoing Managed Infrastructure engagement, the Provider performs a technical assessment. The assessment may cover:

• Infrastructure and server configuration.
• Operating system and software versions.
• Security risks and existing technical debt.
• Administrative access and account arrangements.
• Existing backups and restoration options.
• Monitoring and operational requirements.
• Unsupported or end-of-life components.
• Service scope, exclusions and responsibilities.

9.4. The assessment, onboarding, remediation and any necessary preparatory work may be separately quoted.

9.5. The recurring Managed Infrastructure fee begins only after onboarding has been completed and the engagement has been accepted for ongoing management.

9.6. Customer-owned hosting, registrar, DNS, cloud and other third-party accounts remain the Customer's property and responsibility.

9.7. The Provider will receive only the administrative access reasonably necessary to perform the agreed services. Where practical, access will be provided through a dedicated Provider account rather than shared primary credentials.

9.8. Provider-created monitoring accounts, proprietary platforms, scripts and tools remain the Provider's property.

9.9. Customer-specific configurations and documentation created for the Customer will be made available to the Customer on termination, subject to third-party rights and applicable licences.

9.10. The Provider will revoke or remove its access credentials when they are no longer required, including following termination.

9.11. The Customer remains free to appoint other developers, administrators or service providers.

9.12. The Customer must notify the Provider in advance, where reasonably possible, of planned changes likely to affect the managed environment. The Customer must promptly notify the Provider of emergency or unplanned changes and of relevant administrative access granted to other providers or specialists.

9.13. The Provider may assess the effects of external changes on the scope, security or stability of the managed environment. Additional investigation or corrective work resulting from such changes is separately quoted and requires the Customer's prior approval.

9.14. The Provider is not automatically responsible for consequences of undocumented changes or work performed by the Customer or other providers.

10. Customer responsibilities

10.1. The Customer must provide accurate and complete information, appropriate instructions and the access reasonably required for the Provider to perform the agreed services.

10.2. The Customer is responsible for:

• The legality, accuracy and ownership or licensing of its content and materials.
• Its business operations, users and business decisions.
• Services, applications and systems outside the agreed scope.
• Maintaining appropriate licences and rights.
• Authorising changes and actions that require Customer approval.
• Informing the Provider of relevant system changes and external provider activity.
• Maintaining access to Customer-owned accounts and third-party services.

10.3. The Customer must not knowingly use the services for unlawful purposes or in a manner that creates unreasonable security or operational risks.

10.4. The Customer must cooperate reasonably with the Provider and promptly provide information required to investigate material service issues.

10.5. Delays or additional work caused by incomplete information, missing access, Customer instructions or third-party actions may affect service delivery and may require a separate quotation.

11. Third-party services and external providers

11.1. The Provider may rely on third-party hosting, cloud, software, telecommunications, payment and other services to perform the agreed services.

11.2. Third-party services remain subject to their own terms, technical limitations and availability.

11.3. The Provider is not responsible for failures caused solely by third-party providers, except to the extent that the Provider has breached its own contractual obligations, including any applicable duty to exercise reasonable care in selecting or managing such services.

11.4. The Provider may use independent external specialists where reasonably required. Where a specialist will access Customer systems, data or infrastructure, the Provider will notify the Customer in advance where reasonably practicable. Emergency access may be notified afterward where advance notice is not reasonably practicable.

11.5. Specialist access will be limited to the necessary scope and duration, subject to appropriate confidentiality and security obligations, and revoked when no longer required.

11.6. Where an external specialist acts as a subprocessor of personal data, the DPA and applicable Subprocessor Schedule govern the appointment and notification process.

12. Data protection and security

12.1. Each Party will comply with the data protection laws applicable to its activities.

12.2. Where the Provider processes personal data on behalf of the Customer as a processor within the meaning of the GDPR, the Parties will enter into the applicable DPA before the relevant processing begins.

12.3. The DPA defines the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects, and the respective obligations of the Parties.

12.4. The Provider will implement appropriate technical and organisational measures, as described in the applicable TOMs, taking account of the nature and scope of the processing and the risks involved.

12.5. The Provider operates its own monitoring platform on infrastructure hosted by Hetzner in Germany. Backup services may use Microsoft Azure Blob Storage in a German region as specified in the Service Confirmation.

12.6. The Provider will maintain an updateable Subprocessor Schedule where required. The Customer will receive advance notice of intended additions or replacements of subprocessors involved in GDPR-covered processing and will have 30 days to raise a reasoned data-protection objection.

12.7. The Provider will consider reasonable objections and available alternatives or safeguards. If no workable solution can be agreed, either Party may terminate the affected processing service.

12.8. The Provider will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data processed on the Customer's behalf. The Provider aims to provide an initial notification within 24 hours of awareness, including outside standard support hours, where reasonably practicable.

12.9. The initial notification may be supplemented as further information becomes available. The 24-hour target does not replace or extend any statutory notification deadline.

12.10. The Provider will assist the Customer with reasonable data protection obligations within the scope of the applicable DPA and the services commissioned.

12.11. The Provider will retain and delete personal data in accordance with the applicable DPA, the agreed service retention periods and applicable legal requirements.

13. Fees, invoicing and payment

13.1. Fees are specified in the Service Confirmation.

13.2. Standard subscriptions are month-to-month, with no minimum commitment unless expressly agreed otherwise.

13.3. Monthly subscription fees are billed in advance. Billing begins on the service activation date, not merely on acceptance of the offer.

13.4. Where activation occurs partway through a billing month, the initial fee will be prorated where applicable.

13.5. Subsequent billing generally takes place on the same calendar day of each month. If a month does not contain that day, billing takes place on the final calendar day of that month.

13.6. The Provider may issue invoices and payment links through Stripe or another payment method identified in the Service Confirmation.

13.7. Unless otherwise agreed, payment is due within 14 calendar days of the invoice date.

13.8. Where recurring card payment is agreed, the Customer authorises the relevant payment provider to collect the recurring fees using the selected payment method.

13.9. Setup, onboarding, assessment and other one-time fees will be separately identified in the Service Confirmation. Standard activation is included where no meaningful setup work is required.

13.10. Unless otherwise agreed, fees are stated exclusive of any VAT or other applicable indirect taxes. The Provider will apply the VAT treatment required by law, including the small-business scheme under section 19 UStG where applicable.

13.11. A change in the Provider's VAT status does not automatically change the agreed net contractual fee. Any applicable tax will be treated in accordance with statutory requirements.

13.12. The Customer is responsible for providing accurate billing information and maintaining a valid payment method where recurring automatic payments are used.

14. Failed payments and suspension

14.1. If a payment fails, the Provider or payment provider may attempt collection again using the configured payment process.

14.2. The Provider will notify the Customer of a failed payment and provide an opportunity to resolve it.

14.3. The Customer will have a seven-calendar-day grace period following notification to resolve the payment issue.

14.4. If payment remains outstanding, the Provider may suspend the affected service after written notice, provided suspension is proportionate and legally permissible.

14.5. The Provider will avoid removing agents, disabling security protection or taking other actions that would create unreasonable additional risk merely because payment has failed.

14.6. Persistent non-payment may result in termination of the affected service, subject to applicable law and any required notice or opportunity to remedy.

14.7. Suspension or termination for non-payment does not, by itself, authorise deletion of Customer data.

14.8. Reinstatement may require payment of outstanding amounts and reasonable reinstatement work where necessary.

15. Price changes and additional services

15.1. The Provider may propose changes to recurring fees by giving at least 30 calendar days' written notice.

15.2. Price increases do not apply retroactively. The existing price remains effective until the announced effective date.

15.3. If the Customer does not accept a proposed price increase, the Customer may terminate the affected service before the increase takes effect without an additional cancellation penalty.

15.4. Changes to service scope, additional services and substantial technical changes require the Customer's agreement.

15.5. Nothing in this section permits the Provider to impose a new service or increase fees without the required agreement or statutory basis.

16. Term and termination

16.1. Each recurring subscription begins on the service activation date and continues month-to-month.

16.2. Either Party may ordinarily terminate an ongoing subscription by giving 14 calendar days' notice.

16.3. Notice may be given by email or another agreed written communication channel.

16.4. Either Party may terminate for an important reason where continuation of the contractual relationship cannot reasonably be required under the circumstances.

16.5. Where the important reason is a remediable breach of contract, the terminating Party will generally give the other Party a reasonable opportunity to remedy the breach before termination.

16.6. Immediate suspension or termination may be justified where continued performance would be unlawful, would create a serious and unreasonable security risk, or where the circumstances make prior notice or an opportunity to remedy unreasonable.

16.7. Persistent non-payment, serious misuse, unlawful activity, serious or repeated security violations, or insolvency-related circumstances may justify termination where the applicable legal requirements are met.

16.8. Termination does not affect accrued payment obligations or rights and liabilities arising before the effective termination date.

16.9. Statutory consumer withdrawal rights are separate from ordinary contractual termination and are not restricted by this section.

17. Offboarding, export and deletion

17.1. On termination, the Provider will cooperate reasonably with the Customer to complete ordinary offboarding within the agreed service scope.

17.2. Standard offboarding includes, where applicable and technically available:

• One reasonable export of Customer-owned data in an existing or commonly usable format.
• Existing Customer-specific infrastructure and service configuration documentation held by the Provider.
• Relevant transferable access and account information required to continue operating the Customer's environment.
• A reasonable summary of maintained services and configurations.
• Ordinary removal of Provider access credentials and service agents where appropriate.

17.3. Standard export and basic preparation and provision are included without a separate charge.

17.4. Additional data conversion, restructuring, extensive new documentation, reconstruction of undocumented configurations, migration planning, redevelopment and substantial transition assistance are separately scoped and quoted.

17.5. The Customer must request any required export before the end of the applicable offboarding period and provide a suitable destination or transfer method where necessary.

17.6. The standard export obligation does not require the Provider to create new systems, convert data into unavailable formats or perform complex migration work.

17.7. Active Customer data held in the Provider's systems will generally be deleted within 30 days after the effective service termination date, subject to:

• Applicable statutory retention obligations.
• Legitimate and documented requirements to establish, exercise or defend legal claims.
• Technical limitations affecting deletion from backups or residual copies.

17.8. Backup data is subject to the separate retention and deletion provisions of the Backup and Restoration Schedule.

17.9. The Customer may request an extension of the offboarding period by written agreement. Additional retention or transition services may incur charges.

17.10. The Provider will not delete Customer-owned content, files, databases or configurations merely because the service has ended, except where deletion is expressly authorised, legally required or necessary under an agreed process.

17.11. The Provider may remove its proprietary agents, scripts, monitoring tools and software at termination. Such removal must not intentionally delete Customer-owned content or damage unrelated systems. Ordinary removal is included; complex deinstallation or cleanup may be separately quoted.

17.12. The Provider will revoke or remove its access credentials when no longer required.

17.13. The Provider may retain accounting, contractual, security and other records for applicable statutory periods or for as long as reasonably necessary for legitimate legal and operational purposes. Personal data will be deleted or anonymised when no longer required, subject to applicable law.

18. Intellectual property and ownership

18.1. The Customer retains ownership of its content, data, databases, business information and materials supplied to the Provider.

18.2. The Provider retains all rights in pre-existing software, monitoring tools, scanners, scripts, automation, templates, methods, processes, reusable know-how and other materials developed independently of the Customer's commissioned work.

18.3. The Provider's proprietary monitoring and file-integrity software remains the Provider's intellectual property. The Customer receives only the limited right to use relevant components for the duration and purpose of the commissioned service, unless a separate licence is agreed.

18.4. Customer-specific configurations and documentation may be used by the Customer for its own environment, subject to third-party rights and applicable licence terms.

18.5. Ownership and licensing of custom software or development work must be expressly stated in the Service Confirmation or a separate written agreement.

18.6. Nothing in this Agreement transfers ownership of the Provider's pre-existing intellectual property to the Customer.

19. Confidentiality

19.1. Each Party must protect the other Party's confidential information and use it only for the purposes of the contractual relationship.

19.2. Customer confidential information includes, in particular, credentials, Customer data, business and technical information, unpublished website or infrastructure details, security findings, incidents and configurations.

19.3. Provider confidential information includes proprietary software, scripts, automation, methods, internal documentation, security procedures and non-public commercial information.

19.4. Confidential information may be disclosed to employees, contractors or specialists who reasonably need it for the agreed services, provided they are subject to appropriate confidentiality obligations.

19.5. The confidentiality obligations do not apply to information that the receiving Party can demonstrate:

a. Is publicly available without breach of this Agreement.

b. Was lawfully known to the receiving Party without confidentiality restrictions.

c. Was independently developed without use of the other Party's confidential information.

d. Was lawfully received from a third party without a confidentiality obligation.

19.6. A Party may disclose confidential information where legally required. Where lawful and reasonably practicable, the disclosing Party will notify the other Party before disclosure.

19.7. Confidentiality obligations survive termination for as long as the information remains confidential or is protected by applicable law.

20. Liability

20.1. The Parties are liable in accordance with applicable statutory law, subject to the following contractual provisions where legally permissible.

20.2. The Provider has unlimited liability:

a. For intent and gross negligence.

b. For injury to life, body or health caused by negligence or intent.

c. Where liability cannot legally be limited or excluded.

d. Under any applicable mandatory statutory liability regime.

20.3. In cases of slight negligence, the Provider is liable only for breach of an essential contractual obligation, meaning an obligation whose fulfilment is necessary for the proper performance of the contract and on whose fulfilment the Customer may ordinarily rely.

20.4. In such cases, liability is limited to damage that was foreseeable and typical for this type of contract at the time the contract was concluded, to the extent permitted by applicable law.

20.5. No provision of this Agreement excludes liability for the Provider's failure to perform an expressly agreed obligation where such exclusion would be invalid under applicable law.

20.6. The Parties acknowledge that no general uptime guarantee, uninterrupted availability guarantee, guaranteed prevention of security incidents or unlimited incident response is included unless expressly agreed in writing.

20.7. For standard subscription services, no fixed monetary liability cap is agreed under this Agreement. The limitations in this section remain subject to mandatory statutory law and the requirements governing standard business terms.

20.8. For Managed Infrastructure engagements, any agreed financial liability cap must be expressly stated in the relevant Service Confirmation. The cap must be assessed individually, taking account of the technical scope, criticality, data and backup responsibilities, foreseeable risks and agreed fees.

20.9. For backup services, any specific financial liability cap or additional liability provisions must be expressly stated in the Backup and Restoration Schedule or Service Confirmation. Such provisions must reflect the actual backup frequency, retention, capacity, restoration and testing obligations commissioned.

20.10. A liability cap does not apply where its application would be prohibited by mandatory law.

20.11. The Provider does not guarantee that third-party hosting, cloud, telecommunications, software or other external services will remain continuously available or free from defects. This does not exclude liability for the Provider's own breach of contractual obligations.

20.12. The Provider is not responsible for losses caused solely by the Customer, other providers, undocumented external changes, systems outside the agreed scope or events for which the Provider is not legally responsible.

20.13. Nothing in this Agreement limits the rights of data subjects under Article 82 GDPR or other mandatory data protection rights.

20.14. The Parties acknowledge that the agreed liability provisions do not create a separate legal entity or otherwise alter the legal liability of the Provider as a sole proprietor.

21. Force majeure and third-party disruptions

21.1. Neither Party is responsible for delay or failure to perform to the extent caused by circumstances beyond its reasonable control, including major internet, telecommunications or power outages, hosting, cloud or data-centre failures, natural disasters, fire, war, civil unrest, government restrictions or widespread cyberattacks and infrastructure incidents that could not reasonably have been prevented.

21.2. The affected Party will notify the other Party as soon as reasonably practicable and take reasonable steps to mitigate the effects and resume performance.

21.3. This section does not excuse a Party's own negligence or failure to maintain reasonable safeguards.

21.4. Payment remains due for services already provided.

21.5. If a material disruption continues for 30 consecutive days, either Party may terminate the affected service without an additional termination penalty.

22. Complaints

22.1. The Customer may submit complaints to:

Email: hello@thebuffalocompany.com

22.2. The Provider aims to acknowledge a complaint within two business days.

22.3. The Provider aims to provide a substantive response within ten business days.

22.4. If further investigation is required, the Provider will inform the Customer and provide an expected response date.

22.5. The Parties will attempt to resolve complaints amicably where reasonable. This procedure does not restrict statutory rights or access to competent courts or authorities.

23. Consumers and international customers

23.1. This Agreement may be used with business customers and consumers, subject to the mandatory laws applicable to the relevant Customer and transaction.

23.2. Where the Customer is a consumer, mandatory consumer protection provisions apply notwithstanding any conflicting contractual term.

23.3. Where a statutory right of withdrawal applies, the Customer will receive separate withdrawal information and the applicable model withdrawal form.

23.4. A consumer who expressly requests that services begin before the expiry of the applicable withdrawal period may be required to pay a proportionate amount for services provided before withdrawal, where statutory requirements are met.

23.5. Any statutory expiry of a withdrawal right following full performance of services is subject to the applicable statutory requirements and the required express consent and acknowledgement.

23.6. Nothing in this Agreement constitutes a general waiver of consumer withdrawal rights.

23.7. Customers outside Germany may be protected by mandatory consumer or business laws in their country of residence or establishment. Nothing in this Agreement excludes protections that cannot lawfully be excluded.

24. Governing law and jurisdiction

24.1. This Agreement is governed by the laws of the Federal Republic of Germany, subject to mandatory provisions of law applicable to the Customer or transaction.

24.2. Where legally permissible, the courts having jurisdiction at the Provider's business location shall have jurisdiction over disputes arising from this Agreement.

24.3. This jurisdiction agreement does not apply where mandatory law provides otherwise, including applicable consumer jurisdiction rules.

25. Notices and communications

25.1. Contractual notices may be sent by email to the contact addresses stated in the Service Confirmation or otherwise notified by the Parties.

25.2. The Customer must keep its contact details current and ensure that relevant communications can be received.

25.3. Notices of termination, complaints, service changes and other contractual communications may be sent by email unless mandatory law requires another form.

25.4. The Provider's primary contact address is hello@thebuffalocompany.com.

25.5. The Provider may send invoices, service notices, operational communications and contractual documents electronically.

26. Final provisions

26.1. This Agreement and its applicable contractual documents constitute the agreement between the Parties concerning the commissioned services.

26.2. Amendments and additions must be agreed in writing. Email is sufficient unless mandatory law requires a stricter form.

26.3. If an individual provision of this Agreement is invalid or unenforceable, the remaining provisions remain effective to the extent permitted by law. The invalid or unenforceable provision will be replaced by the applicable statutory rule.

26.4. Neither Party may transfer its contractual rights or obligations to a third party without the other Party's consent, except where the transfer is permitted by law or forms part of a lawful business succession that does not materially prejudice the other Party.

26.5. The Provider may use subcontractors and specialists in accordance with this Agreement and the applicable DPA.

26.6. No waiver of a contractual right is effective unless clearly communicated by the Party granting the waiver.

26.7. This Agreement becomes applicable to a particular service when the relevant Service Confirmation is accepted by the Parties.

---

End of Managed Services Agreement