General Terms and Conditions (GTC)

incl. Data Processing Agreement (DPA) pursuant to Art. 28 GDPR

Seatsmatch GmbH – VirtualHub | Version 1.0 | As of: March 2026

Contracting Parties

Provider (Processor): Seatsmatch GmbH, Seitenstettengasse 5/37, 1010 Vienna – [email protected]

Operator (Controller): The company specified during registration

PART I – General Terms and Conditions

§ 1 Scope and Subject Matter

(1) These General Terms and Conditions (hereinafter "GTC") of Seatsmatch GmbH (hereinafter "Provider") apply to all contracts for the use of the SaaS platform VirtualHub concluded between the Provider and commercially active companies (hereinafter "Operator").

(2) The Operator is a company that uses the software to offer its own customers (hereinafter "End Customers") services in the area of digital mail management, document processing, and/or automated invoicing.

(3) The subject matter of the contract is the provision of the following software modules in a SaaS model:

• Mail Hub: Receipt, opening, scanning, and digital provision of physical mail items of End Customers
• Payment Hub: Automated creation, management, and provision of invoices for End Customers

(4) Conflicting or deviating GTC of the Operator shall not apply unless the Provider has expressly agreed to their validity in writing.

(5) These GTC apply exclusively to entrepreneurs within the meaning of the Austrian Business Code (UGB) or the German Commercial Code (HGB). Consumer transactions are excluded from the scope.

§ 2 Contract Conclusion and Registration

(1) The contract is concluded by accepting these GTC during the registration process on the platform. Acceptance via checkbox constitutes an electronic declaration within the meaning of § 4 ECG and is legally binding.

(2) The Operator is obliged to provide complete and truthful information during registration and to update it immediately in the event of changes.

(3) The Provider is entitled to refuse access to the software or to block an existing account if there are legitimate reasons, in particular in the case of false registration information or suspicion of misuse.

§ 3 Scope of Services and Availability

(1) The Provider provides the software as Software-as-a-Service (SaaS) via the Internet. There is no obligation to provide local installations.

(2) The Provider aims for system availability of 99.0% on an annual average, measured outside of agreed maintenance windows. Planned maintenance work will be announced to the Operator at least 48 hours in advance.

(3) Disruptions caused by circumstances beyond the Provider's control (e.g., internet outages, disruptions at third-party providers, force majeure) do not constitute a breach of contract.

(4) The Provider is entitled to adjust the scope of services of the software or to change individual functions, provided that the Operator is notified in due time and essential contractual obligations are not restricted.

§ 4 Obligations of the Operator

(1) The Operator is obliged to use the software exclusively for the purposes specified in these GTC and the DPA (Part II).

(2) The Operator must ensure that it obtains the express, written consent of its End Customers before using the Mail Hub, in particular:

• Consent to opening and scanning of physical mail items
• Consent to digital storage and processing of contents
• Information about the involvement of the Provider as a technical service provider

(3) The Operator shall provide the Provider with evidence of the consents obtained from its End Customers upon request.

(4) The Operator is responsible for compliance with all legal obligations in the relationship with its End Customers, particularly in the areas of data protection, postal secrecy, and contract law.

(5) The Operator is obliged to treat access credentials to the software confidentially and to prevent unauthorized access by third parties. In the event of suspected misuse, the Provider must be informed immediately.

§ 5 Fees and Payment Terms

(1) Fees are based on the applicable price list of the Provider or an individually agreed pricing arrangement.

(2) Invoices are to be paid within 14 days of the invoice date without deduction.

(3) In the event of late payment, the Provider is entitled to charge default interest at the statutory rate and to temporarily suspend access to the software.

(4) All prices are exclusive of the applicable statutory value-added tax.

(5) The Provider is entitled to change its prices with a notice period of at least 6 weeks. If the Operator does not object to the price adjustment within 4 weeks of notification, this shall be deemed consent.

§ 6 Contract Duration and Termination

(1) The contract runs for an indefinite period and may be terminated by either party with 4 weeks' notice to the end of the month, unless a different term has been agreed.

(2) The right to extraordinary termination for good cause remains unaffected. Good cause exists in particular if the Operator violates essential contractual obligations, especially data protection obligations under the DPA.

(3) After termination of the contract, the Operator is obliged to block all access credentials and to inform the Provider of the measures taken for data backup and deletion.

§ 7 Liability

(1) The Provider is liable without limitation for damages caused by intent or gross negligence.

(2) For slight negligence, the Provider is only liable for the breach of essential contractual obligations (cardinal obligations). In this case, liability is limited to the foreseeable, contract-typical damage.

(3) The Provider is not liable for damages arising from the Operator's failure to obtain the required consents from its End Customers.

(4) The Provider is not liable for the loss or damage of physical mail items insofar as these are not processed by the Provider itself.

(5) Claims for damages by the Operator shall become time-barred after 2 years from knowledge of the damage.

§ 8 Intellectual Property and Usage Rights

(1) All rights to the software, in particular copyrights and industrial property rights, remain with the Provider.

(2) The Operator receives a simple, non-transferable right to use the software for the duration of the contract and for the agreed purpose.

(3) Any reproduction, distribution, decompilation, or other use of the software beyond the agreed purpose is prohibited without the express written consent of the Provider.

§ 9 Confidentiality

(1) Both parties undertake to treat all confidential information obtained in the course of the contractual relationship as confidential and not to disclose it to third parties.

(2) This obligation also applies after termination of the contract for a period of 5 years.

§ 10 Amendments to the GTC

(1) The Provider is entitled to amend these GTC. Amendments will be communicated to the Operator by email with a notice period of at least 6 weeks before they take effect.

(2) If the Operator does not object to an amendment within 4 weeks of receipt of the notification, the amended GTC shall be deemed accepted. This consequence will be expressly stated in the notification.

§ 11 Final Provisions

(1) Austrian law shall apply, excluding the UN Convention on Contracts for the International Sale of Goods.

(2) The exclusive place of jurisdiction for all disputes arising from this contract is Vienna, insofar as legally permissible.

(3) Should individual provisions of these GTC be or become invalid, this shall not affect the validity of the remaining provisions.

(4) No oral side agreements exist. Amendments and additions to this contract require written form or electronic confirmation to be valid.

PART II – Data Processing Agreement (DPA)

pursuant to Art. 28 GDPR – based on the WKO template (as of June 2024)

Part of these GTC – effective upon acceptance during registration

Controller (Art. 4 No. 7 GDPR): The Operator

Processor (Art. 4 No. 8 GDPR): Seatsmatch GmbH, Seitenstettengasse 5/37, 1010 Vienna

Note per WKO template: For processing outside the EU/EEA (e.g., Supabase/USA), the EU Standard Contractual Clauses (Implementing Decision 2021/914) additionally apply.

Section 1 – Subject Matter of the Agreement

(1) The subject of this order is the operation of the SaaS platform VirtualHub by the Processor for the Controller, in particular:

• (a) digital storage and provision of scanned mail items of the Controller's End Customers (Mail Hub)
• (b) processing of invoicing and customer master data of End Customers (Payment Hub)
• (c) provision of an access-restricted online portal

(2) This agreement is to be understood as Part II of the GTC between Controller and Processor and supplements the SaaS usage contract governed in Part I.

(3) The following data categories are processed:

• Contact data of End Customers: name, address, email address, phone number
• Communication data: contents of scanned mail items, contractual documents where applicable
• Financial data: invoice amounts, IBAN (where relevant for Payment Hub)
• Usage data: login times, access logs, system logs

(4) The following categories of data subjects are subject to processing: End Customers of the Controller and their employees.

Section 2 – Duration of the Agreement

(1) The agreement is concluded for an indefinite period and ends with the termination of the main contract (Part I of these GTC). The notice period is 4 weeks to the end of the month. The right to extraordinary termination for good cause remains unaffected.

Section 3 – Obligations of the Processor

(1) The Processor undertakes to process data and processing results exclusively within the scope of the Controller's written instructions. If the Processor receives an official order to disclose the Controller's data, it shall – insofar as legally permissible – inform the Controller immediately and refer the authority to the Controller.

(2) The Processor declares in a legally binding manner that all persons entrusted with data processing have been obliged to maintain confidentiality before commencing their activities or are subject to an appropriate statutory obligation of secrecy. The obligation of secrecy shall remain in force even after termination of the activity.

(3) The Processor declares in a legally binding manner that it has taken all necessary measures to ensure the security of processing pursuant to Art. 32 GDPR. Details can be found in Annex ./1 (Technical and Organizational Measures).

(4) The Processor shall take technical and organizational measures to enable the Controller to fulfill the rights of data subjects under Chapter III GDPR (access, rectification, erasure, data portability, objection) within the statutory deadlines. If a corresponding request is made directly to the Processor, it shall be forwarded to the Controller without delay.

(5) The Processor supports the Controller in complying with the obligations pursuant to Art. 32–36 GDPR, in particular: data security measures; reporting data breaches to the supervisory authority (without delay, at the latest within 24 hours of becoming aware); notification of affected persons; data protection impact assessment; prior consultation.

(6) The Processor is advised that it must establish and maintain a record of processing activities pursuant to Art. 30 GDPR for the present commissioned processing.

(7) The Controller is granted the right to inspect and control the processing of the entrusted data at any time, including through commissioned third parties. Audits must be announced with a notice period of at least 4 weeks.

(8) Upon termination of this agreement, the Processor is obliged to hand over all processing results and documents containing data to the Controller or to destroy them on behalf of the Controller. Data will be provided either in the original format or in a common standard format (PDF, CSV, JSON). Deletion shall take place no later than 90 days after the end of the contract; the Processor shall confirm the deletion in writing.

(9) The Processor shall inform the Controller immediately if it believes that an instruction from the Controller violates data protection provisions of the Union or the Member States.

Section 4 – Location of Data Processing

(1) Data processing activities are primarily carried out within the EU/EEA. The Processor uses Supabase as its database infrastructure with an EU server location (Frankfurt/Germany).

(2) Insofar as processing in third countries cannot be completely excluded within the scope of Supabase or other services, the Processor ensures that this takes place on the basis of the EU Standard Contractual Clauses pursuant to Implementing Decision 2021/914 of the European Commission.

Section 5 – Sub-Processors

(1) The Processor is authorized to engage the following sub-processors:

(2) Intended changes to the sub-processor must be communicated to the Controller in writing in sufficient time to allow objection (objection period: 14 days). The Processor shall conclude the necessary agreements within the meaning of Art. 28(4) GDPR with the sub-processor. It must be ensured that the sub-processor enters into the same obligations that the Processor is subject to under this agreement.

(3) If the sub-processor fails to fulfill its data protection obligations, the Processor shall be liable to the Controller for compliance with the sub-processor's obligations.

Annex ./1 – Technical and Organizational Measures (TOMs)

pursuant to Art. 32 GDPR

A. Confidentiality

Physical access control – Protection against unauthorized access to data processing facilities:

• Keys / access cards
• Alarm systems
• Visitor escort

System access control – Protection against unauthorized system use:

• Passwords incl. password policy
• Two-factor authentication (2FA)
• Automatic locking mechanisms during inactivity

Data access control – No unauthorized reading/copying/modification:

• Authorization profiles on a need-to-know basis
• Access logging
• Periodic review of permissions
• Privacy-compliant disposal of data no longer needed

B. Data Integrity

Transfer control – No unauthorized reading/copying during transmission:

• Encryption during transmission (TLS 1.3 / HTTPS)
• Encryption of stored data (AES-256 or equivalent, via Supabase)

Input control – Determining who entered/changed data:

• Logging / Audit Logs
• Document management

C. Availability and Resilience

Availability control – Protection against destruction/loss:

• Backup strategy (Supabase: automatic daily backups, encrypted)
• Antivirus / Firewall
• Reporting channels and emergency plans
• Security checks at infrastructure and application level

Rapid recoverability: Yes

D. Procedures for Regular Review

• Data protection management incl. regular employee training
• Incident response management (notification to Controller within 24h)
• Privacy by default settings
• Order control: No processing without instruction from the Controller

Seatsmatch GmbH · VirtualHub · GTC incl. DPA · Version 1.0 · As of March 2026
Questions: [email protected] · virtualhub.seatsmatch.com