General Terms and Conditions for Envolva

This English text is a convenience translation of the German version. The German version prevails (section 20.9).

These General Terms and Conditions ("GTC") govern the contracts between Kahriman GmbH and companies that buy Envolva directly. Every person who uses the software is also bound by Envolva's Terms of Use. Companies that use Envolva through a Partner do not enter into a contract under these GTC (section 1.3).

1. General Provisions

1.1 Provider and Contracting Parties

The provider of the Envolva® Services is Kahriman GmbH, Ferdinand-Wallbrecht-Str. 34, 30163 Hanover, Germany, registered with the Local Court of Hanover under HRB 204308, represented by its managing director Murat Kahriman, VAT ID No. DE266271357 ("Envolva", "we" or "us").

Contact: info@envolva.de, www.envolva.de.

The contracting party is the company or organization that buys a Package from Envolva or accepts an offer from Envolva ("Customer").

1.2 Conclusion of Contract

The contract is concluded in one of these ways:

• The Customer orders a Package in the Workspace and pays by card. The contract is concluded as soon as the payment provider has confirmed the payment.
• The Customer orders a Package in the Workspace on invoice. The contract is concluded as soon as Envolva has confirmed the order by email; the invoice comes with the confirmation.
• The Customer accepts an offer from Envolva in text form.

By ordering, the Customer accepts these GTC in the version shown. Envolva stores which version the Customer accepted and when.

Envolva may reject orders, require additional checks, or make activation subject to payment, security or compliance checks. An automatic acknowledgement of receipt is not yet an acceptance unless it is expressly designated as acceptance. The free demo (section 4.6) does not create a contract for a Package.

1.3 Scope

These GTC apply to all services that Envolva provides to the Customer under a contract pursuant to section 1.2, in particular the software, Packages, Extensions, support, expert sessions and the audit of the GHG Report.

Every person who uses the software also accepts Envolva's Terms of Use. Between Envolva and the Customer, these GTC take precedence over the Terms of Use.

These GTC do not apply between Envolva and Partners or Partner Clients (section 2.8). Partners are governed by their partner contract. Partner Clients use the software only on the basis of the Terms of Use; the contract, prices, invoices, renewal and support exist solely between the Partner Client and its Partner.

The Customer's terms and conditions apply only if Envolva expressly agrees to them in text form. Silence, performance of services or opening access does not constitute consent to the Customer's terms.

1.4 Priority of Individual Agreements

Individual offers, order confirmations, service descriptions, data protection agreements, data processing agreements and other expressly agreed individual arrangements take precedence over these GTC to the extent that they regulate the same subject matter differently.

Product descriptions, website texts, marketing materials, demos, help texts and documentation describe the Services, but do not create further guarantees, agreed characteristics or success obligations unless they expressly become part of an offer or individual agreement.

1.5 No Consumer Offering / B2B Use

Envolva is directed at companies, organizations, merchants, self-employed persons, public authorities and other professional users. The Services are not intended for consumers within the meaning of section 13 of the German Civil Code (BGB). The Customer confirms that it uses the Services for professional, commercial, entrepreneurial, governmental or organizational purposes.

If a natural person uses the Services for a Customer, that person acts on behalf of that Customer and confirms that they are authorized to do so.

2. Definitions

2.1 Envolva Services

Envolva Services are the services Envolva provides to the Customer: the Envolva software as an online service (SaaS) with Workspaces, Packages and Extensions, the AI Functions, support, the expert sessions, the audit of the GHG Report by Independent Auditors, and the help pages.

2.2 Customer, Workspace and User

"Customer" is the company that is Envolva's contracting party (section 1.1). A "Workspace" is the area in Envolva in which the Customer works for one reporting unit and one Reporting Year: data, reports, files, team, sites and billing details. "Users" are the persons to whom the Customer gives access to a Workspace.

2.3 Reporting Year, Package and Extension

A "Reporting Year" is the period the Customer reports on, usually a financial year. Envolva sells Reporting Years: a "Package" covers one Workspace and therefore one Reporting Year. The Packages are Sustainability Report Basic, Sustainability Report Comprehensive and GHG Report (section 3). An "Extension" adds to a Package; the Extensions today are Scope 3 and DIN EN ISO 14064-1.

Envolva owes a service only if it is included in the Package or Extension bought or has been agreed separately.

2.4 Customer Data

"Customer Data" means all data, content, documents, information, figures, activity data, company information, user information, report information, files, entries, prompts, evidence, billing data and other information that the Customer or its Users enter, upload, import, generate or process with Envolva.

2.5 Reports and Files

"Reports" are the Sustainability Report, the DMA and the GHG Report that the Customer prepares in Envolva. "Files" are the outputs of these Reports, currently PDF and Excel files (section 4.3). Envolva generates them from the Customer Data and the logic of the software.

2.6 AI Functions and Text Suggestions

"AI Functions" are functions in which an AI model generates, reads or matches content: Helphy, text suggestions in Reports and in the DMA, the reading of uploaded evidence and documents, and the matching of emission factors in the Factorbank (section 4.4). A "Text Suggestion" is a text proposed by an AI Function. AI Functions do not replace professional, legal or tax review or a decision of the Customer.

2.7 External Services

"External Services" are third-party services that may be used or connected for the provision or use of the Envolva Services, in particular payment service providers, hosting and infrastructure providers, AI providers, email services, security and monitoring services, XBRL, validation or conversion services as well as third-party platforms, systems or interfaces.

2.8 Partners and Partner Clients

A "Partner" is a company that has concluded a partner contract with Envolva and gives its own clients access to Envolva. A "Partner Client" is a company that uses Envolva through a Partner. These rules apply to every current and future Partner.

2.9 Independent Auditors

"Independent Auditors" are auditing companies that audit and sign the GHG Report in Envolva (section 3.6). They are independent companies and not employees of Envolva.

2.10 Terms of Use

The "Terms of Use" are Envolva's rules for every person who uses the software. They apply in addition to these GTC.

3. Subject Matter of the Contract

3.1 Software for Reporting Years

Envolva provides the Customer with the Envolva software. With it, the Customer prepares a Sustainability Report, a DMA or a GHG Report for a Reporting Year. The scope of services is set by the Package and Extensions bought and by the order summary in the checkout or the accepted offer.

Envolva delivers software. The content of the Reports comes from the Customer: the Customer enters the data, decides on disclosures and texts, and is responsible for how it uses the Reports (sections 5.2, 5.3 and 8.6). Envolva does not owe any specific economic, regulatory, accounting or third-party-recognized outcome unless this has been agreed separately.

3.2 Sustainability Report (VS)

The Sustainability Report follows the EU voluntary sustainability reporting standard (VS) under Commission Delegated Regulation (EU) 2026/1560.

• The Sustainability Report Basic Package contains the Basic Module with disclosures B1 to B11, Scope 1/2 emissions accounting for disclosure B3, the DMA (double materiality assessment), the AI Functions, output as PDF, and Operator Support.
• The Sustainability Report Comprehensive Package additionally contains the Comprehensive Module with disclosures C1 to C9.

A Workspace contains at most one of these two Packages; either can be combined with the GHG Report Package. Envolva generates the PDF report once the disclosures are completed and the software's readiness check has passed.

The DMA provides internal orientation for the report; it does not decide which disclosures apply. The Scope 1/2 emissions accounting in the Sustainability Report is not a GHG Report and does not include Scope 3. The Sustainability Report has no audit and signature step by Independent Auditors.

3.3 GHG Report and Extensions

The GHG Report Package contains:

• the GHG Report under the GHG Protocol Corporate Accounting and Reporting Standard with Scope 1/2 emissions accounting, methodology, boundaries, evidence annexes, and a hotspot and action agenda,
• the audit and signature by Independent Auditors (section 3.6),
• output as PDF with annexes and as an Excel file,
• the AI Functions, Operator Support and three expert sessions of 60 minutes each (section 4.2).

The DMA is not part of this Package; it belongs to the Sustainability Report Packages.

The Customer can add two Extensions to the GHG Report Package:

• Scope 3: value-chain categories and the Factorbank, which uses AI to match emission factors to entries (section 4.4).
• DIN EN ISO 14064-1: report content and structure under this standard, including the significance assessment of indirect emissions under clause 5.2.3 of the standard. The Extension requires the Scope 3 Extension; it cannot be booked without Scope 3.

Both Extensions are available only together with the GHG Report Package.

3.4 No Legal, Tax or Statutory Audit Service

Envolva does not provide legal advice, tax advice, statutory audits or certification. The audit of the GHG Report under section 3.6 is not a statutory audit, not a certification and not an accredited verification under DIN EN ISO 14064-3, unless agreed separately. Support and expert sessions are not legal or tax advice.

3.5 No Guarantee of Recognition by Third Parties

Envolva does not guarantee that banks, customers, suppliers, auditors, public authorities, platforms, funding bodies, certification bodies or other third parties will accept Reports, Files, metrics or other results.

The scope assessment in Envolva shows which disclosures are not applicable, applicable or recommended, based on the Workspace profile. It is a recommendation. Whether a result is sufficient for a recipient, purpose, standard, period or jurisdiction is for the Customer to check before passing it on.

3.6 Audit and Signature of the GHG Report

Envolva provides the audit of the GHG Report by Independent Auditors. The process:

1. The Customer completes its input and marks the Report as ready for review. From then on, input, Text Suggestions and report texts are locked. As long as the audit has not started, the Customer can reopen the Report as a draft.
2. An Independent Auditor starts the audit, reviews the Report and the evidence in Envolva, and marks it as reviewed. During the audit, the auditor can reopen the Report as a draft for revision.
3. The auditor signs the Report. Envolva stores the auditor's name and email address and the date of the sign-off. The Report names the auditor and the date.
4. Only the auditor can reopen a signed Report, through a correction.

The Independent Auditors are independent companies and not employees of Envolva. They decide independently on professional matters and are themselves responsible for their audit and signature. For the audit, they access the Customer's Workspace.

Envolva owes the audit process, not a particular audit result and not the signature: whether the auditor signs depends on the Customer's data and evidence. The Report always shows its review status. The Customer can download Files before the signature; it presents a Report as audited only once it is signed.

4. Scope of Services

4.1 Relevant Scope of Services

The scope of services is set by the Package and Extensions bought, the order summary in the checkout or the accepted offer, and the functions enabled in the Workspace. Which functions a User sees also depends on the User's role, the payment status and the status of the Report.

4.2 Support and Expert Sessions

Every Package includes Operator Support: help with getting started, with questions about the Workspace and with using the software, by chat, by email and through the help pages.

The GHG Report Package includes three expert sessions of 60 minutes each. In these sessions, the Customer discusses methodology questions about its GHG Report with an expert provided by Envolva. If the Customer needs more sessions, Envolva offers them; scope and price are agreed beforehand.

Support and expert sessions serve the use of the software and the methodology. They are not legal, tax or audit services and not part of the audit under section 3.6.

4.3 Files and Formats

Envolva generates the Files from the stored Customer Data. The Sustainability Report and the DMA are available as PDF; the GHG Report as PDF with annexes and as an Excel file.

Envolva does not currently offer an XBRL output for the Sustainability Report. Envolva plans to offer it once an official EU taxonomy package for VS exists; the Customer has a claim to it only once Envolva offers it.

The software checks completeness and plausibility. These checks do not replace the Customer's professional review. An auditor's signature in Envolva is not a qualified electronic signature.

4.4 AI Functions

Envolva uses AI in these functions:

• Helphy is an AI assistant. Helphy answers questions about forms and disclosures and suggests texts, for example a draft, a correction or a rephrasing. Its answers are generated by an AI model, not by a person.
• Text Suggestions in Reports and in the DMA.
• Evidence and documents: Envolva reads uploaded invoices and documents with text recognition and AI and suggests values. The software discards values that do not appear in the document.
• Factorbank (Scope 3 Extension): the AI matches emission factors to entries. Matches that the software's review rules do not classify as reliable go to a further review.

For all AI Functions:

1. AI results can be wrong, incomplete or unsuitable for the purpose. Envolva labels texts proposed by an AI as Text Suggestions in the application.
2. The Customer decides on every suggestion: it applies it, discards it or rewrites it. Text Suggestions in the GHG Report appear labelled in the draft; when the Customer marks the Report as ready for review, it adopts the texts it has not changed or replaced by then.
3. The Customer carries the editorial responsibility for texts it adopts. Envolva provides the suggestion, not the content.
4. Envolva may limit the number of AI requests per Workspace. The application shows when the limit is reached.

Envolva aligns the AI Functions with the transparency obligations under Article 50 of Regulation (EU) 2024/1689 (AI Act). If the Customer publishes texts generated by an AI, the Customer checks whether it must disclose this.

The Customer does not enter special categories of personal data, third-party trade secrets or employee data that the Report does not need into AI Functions.

4.5 Changes and Further Development

Envolva may further develop, update, improve, secure and adapt the Services to technical, legal, regulatory, product-related or economic requirements. Envolva may change, replace or remove functions provided that this does not unreasonably impair the essential contractual benefit of the Package bought.

Envolva will notify the Customer in an appropriate manner of material changes that significantly impair the use of a Package, where this is required and practically possible given the nature of the change.

4.6 Demo, Beta and Preview Functions

Envolva may provide a company with a free demo Workspace for 21 days. In the demo

• the Customer tries out the functions of the Sustainability Report and the Scope 1/2 emissions accounting; the GHG Report is not included;
• downloads of the Customer's own data stay locked; sample files are available for download;
• the Customer cannot add further reports.

After 21 days, the demo Workspace is read-only. If the Customer buys a Package for the demo Workspace, it becomes the Customer's Workspace and the input is kept. The demo creates no payment obligation. Envolva may change or end the demo at any time.

Functions that Envolva labels as beta or preview may be incomplete, error-prone or time-limited. Without separate approval, the Customer does not use them for external, legally binding or audit-relevant purposes.

4.7 Distinction from Marketing and Website Statements

Website, marketing, presentation, demo and sales content describes the expected product benefit. It is not a guarantee, not an assurance of specific characteristics and not an obligation to achieve a specific reporting success unless it has been expressly included in an offer or individual agreement.

In the event of contradictions between marketing statements and an individual agreement, the individual agreement applies. In the event of contradictions between product documentation and these GTC, these GTC apply unless there is a prior-ranking individual agreement.

5. Customer Obligations

5.1 Lawful Use

The Customer uses the Envolva Services only lawfully, in accordance with the contract and within the enabled entitlements. The Customer ensures that its Users accept and comply with the Terms of Use and observe applicable laws, third-party rights, data protection requirements, export control requirements and internal approval processes.

5.2 Responsibility for Input

The Customer is responsible for the accuracy, completeness, timeliness and lawfulness of its input. This includes company data, consumption and activity data, employee and financial data, supplier data, evidence, uploaded documents and texts. If the software calculates wrong results from wrong or incomplete input, the Customer is responsible for them. Defects of the software itself are governed by sections 16 and 17.

The Customer ensures that it has all required rights, consents, legal bases, approvals and authorizations to process Customer Data in Envolva.

The Customer enters personal data, third-party trade secrets and especially sensitive information only if the Report or billing requires them and the Customer may process them lawfully.

5.3 Review of Reports and Results

The Customer reviews Reports, Files, metrics, the selected emission factors and adopted AI suggestions before it marks a Report as ready for review, makes internal decisions, publishes or passes them on.

The Customer decides on its own responsibility whether a result is suitable for a specific recipient, purpose, standard, jurisdiction, period or business process. It clarifies additional requirements of banks, customers, tendering bodies, auditors, public authorities, platforms or industry programs before passing results on.

5.4 User Management and Access Security

The Customer is responsible for managing its Users, roles, permissions, passwords, authentication procedures and access security. Access credentials must not be shared, sold, transferred or made available to unauthorized persons.

The Customer must inform Envolva without undue delay if there is a suspicion that access has been compromised or is being used without authorization.

5.5 Employee and Site Information; Usage Limits

The Customer states correctly the number of employees in full-time equivalents (FTE), the number of sites and whether it reports as a group. These figures determine the price (sections 10.1 and 10.7). If they change, the Customer updates them in the Workspace.

The Customer complies with the agreed usage limits and does not circumvent Package, payment, role or download restrictions.

5.6 Cooperation

The Customer provides in good time the information, data, contacts, approvals, payments and decisions Envolva needs to perform. For the audit of the GHG Report, the Customer provides the evidence the auditor requests and answers the auditor's questions. Delays or errors caused by missing, late, incomplete or incorrect cooperation by the Customer are not attributable to Envolva.

5.7 Prohibition of Misuse

The Customer must not misuse the Services, in particular not to violate laws, third-party rights, security mechanisms, platform integrity or system limits. In particular, unauthorized scraping, reverse engineering, manipulation, overload, malware, circumvention of access controls, unlawful content, unauthorized sharing of access credentials and use for third parties outside the agreed contractual scope are prohibited.

6. Envolva Obligations

6.1 Provision of the Platform

Envolva provides the Customer with the agreed SaaS functions within the technical, operational and contractual possibilities. Provision generally takes place via the internet. The Customer is responsible for its internet connection, end devices, browsers, local IT environment and organizational usage prerequisites.

6.2 Appropriate Technical and Organizational Measures

Envolva takes appropriate technical and organizational measures to operate the platform, control access, protect data and reduce disruptions. The specific measures may change as a result of technical, organizational or security-related development.

6.3 Support Within the Agreed Scope

Envolva provides support under section 4.2. Response times, availability, support channels or service levels apply only if expressly agreed.

6.4 Maintenance and Availability

Envolva endeavors to provide appropriate availability of the Services. Maintenance, security measures, updates, disruptions, force majeure, third-party provider issues, internet issues, payment issues or Customer-side causes may impair availability.

Unless expressly agreed, Envolva does not owe any specific minimum availability, uninterrupted use or continuous availability of individual functions.

6.5 Handling of Disruptions

Envolva will review reported disruptions within its operational possibilities and take appropriate measures to remedy or work around them. The Customer must report disruptions in a comprehensible manner and support Envolva in the analysis to the extent required and reasonable.

7. Rights of Use

7.1 SaaS Access Right

For the duration of the Service Period of a Package (section 11.1), the Customer receives a simple, non-exclusive, non-transferable, revocable right, limited to the agreed scope, to access the Envolva Services and use them for its own internal business and reporting purposes. After a Package ends, sections 8.4 and 11.6 apply.

7.2 Authorized Users and Terms of Use

The Customer gives access only to authorized persons. User accounts are personal. Every User accepts the current version of the Terms of Use at their first login and after each change; Envolva stores the version accepted. The Customer is responsible for the actions of its Users as for its own actions.

7.3 Usage Restrictions

The Customer must not rent, lease, sell, sublicense, make publicly available, offer as its own product, operate for unauthorized third parties or use the Services outside the agreed contractual scope.

7.4 Prohibition of Reverse Engineering and Circumvention

To the extent permitted by law, the Customer must not reverse engineer, decompile, circumvent, manipulate, copy or use the Services, software, workflows, data models, interfaces, protection mechanisms, pricing logic or output paths to develop competing products.

7.5 Suspension in the Event of Security Risks or Breaches of Duty

Envolva may temporarily suspend or restrict access, Users, Workspaces, downloads or functions if this is necessary to prevent or limit security risks, legal violations, payment arrears, misuse, system risks, rights violations or material contractual breaches. Envolva will take the Customer's legitimate interests into account to the extent possible in the circumstances.

8. Customer Data, Reports and Downloads

8.1 Customer Ownership of Customer Data

As between Envolva and the Customer, Customer Data remains the property or responsibility of the Customer. Envolva does not acquire ownership rights in Customer Data. However, the Customer grants Envolva the rights required to host, process, transmit, secure, display, evaluate and output Customer Data to the extent necessary to provide the Services.

8.2 Processing for Service Provision

Envolva processes Customer Data to provide, secure, maintain, bill, support, improve and further develop the Services and to fulfill legal and contractual obligations. Personal data is processed in accordance with the data protection agreements, the privacy policy and applicable data protection law.

8.3 Downloads During the Service Period

During the Service Period, the Customer downloads the Files of its Reports in the Workspace once the payment has been received (section 10.4). Envolva does not owe customer-specific special exports, database extracts, raw data formats or format conversions unless expressly agreed.

The Customer keeps its Files itself. Envolva is not an archive for the Customer; section 8.4 remains unaffected.

8.4 Archive Page After the End

If a paid Package ends without renewal, Envolva archives the Reporting Year (section 11.6). On the archive page, the Customer can download the finished Files of that Reporting Year for twelve months after the end: the GHG Report as PDF, the GHG inventory as an Excel file and the Sustainability Report as PDF, to the extent they were created. Envolva records every download with date and person. After twelve months, access to the archive page ends.

8.5 Deletion After the End

Twelve months after the end of a Reporting Year without renewal, Envolva deletes or anonymizes the Customer Data of that Reporting Year. Before that, Envolva announces the deletion by email to the address on file. Envolva keeps invoices and other records it must retain for as long as the law requires. Backup copies are deleted with the usual backup cycles and are not used productively until then.

8.6 Responsibility for the Use of Reports

The Customer decides on its own whether, when, to what extent and to whom it uses, publishes, submits or passes on Reports or Files. This also applies to texts based on a Text Suggestion. Envolva provides software results and assumes no responsibility for the Customer's external use, submission, publication or business decision.

9. External Services and Integrations

9.1 Payment Services

Card payments are processed by an external payment provider. Additional terms and privacy notices may apply to its services. Envolva is not responsible for disruptions, rejections, delays or errors that fall within the responsibility of the payment provider, the bank, the card issuer or the Customer.

9.2 Validation and Conversion Services

Envolva may use internal or external services for validations, technical checks or format processing. They support technical diagnostics and output formats but do not guarantee external acceptance or the substantive correctness of the Customer Data.

9.3 AI and Infrastructure Providers

Envolva uses external providers for hosting, AI models, text recognition, email, security and monitoring. AI providers process the input an AI Function needs for its result. They process personal data only under the data processing agreement, which contains the list of sub-processors.

9.4 Third-Party Terms

When External Services are used, additional terms, service limits, availability, privacy information or usage rules of third parties may apply. The Customer is responsible for complying with such terms to the extent they are communicated to the Customer or are relevant for the use.

9.5 No Responsibility for External Platforms

Envolva is not responsible for platforms, systems, standards, interfaces, databases, portals, validation bodies, public authorities, banks, auditors, customers, suppliers or other third parties outside its own area of responsibility. Changes by such third parties may affect usability, acceptance, output formats or workflows.

10. Prices and Payment Terms

10.1 Prices

The prices shown in the checkout or the offer apply. The annual price of a Package depends on the Package, the Extensions, the number of employees (FTE) and the number of sites. Three sites are included in the price; each further site costs a surcharge per Reporting Year. For more than 1,000 employees, more than ten sites or a group report, Envolva prepares a personal offer.

All prices are exclusive of statutory value added tax.

10.2 Payment Methods

The Customer pays by card or on invoice.

• Card: the payment provider charges the card automatically on ordering and on each renewal (section 11.2).
• Invoice: Envolva offers payment on invoice to companies based in Germany and to other companies by agreement. To order on invoice, the Customer needs a confirmed email address and a complete billing address (company, contact email, street, postcode, city, country). While another invoice of the Customer is unpaid, the Customer cannot order on invoice again.

10.3 Extensions and Additional Services

Envolva owes Extensions (Scope 3, DIN EN ISO 14064-1), additional expert sessions, migrations and other special services only if the Customer has bought them or they have been expressly agreed. They are charged separately.

10.4 Invoice, Due Date and Unlocking

Invoices are due 14 days after the invoice date unless the invoice states another date. Payments must be received in full and without deduction.

When ordering on invoice, the Customer can work in the Workspace at once; Envolva unlocks downloads once the payment has been received. With card payment, Envolva activates the Package once the payment provider has confirmed the payment. This applies to all Files, including the GHG Report.

10.5 Payment Default

While a due payment is outstanding, downloads stay locked. This also applies if a card charge fails on renewal, until the payment succeeds.

In the event of payment default, Envolva may claim statutory default interest, reminder costs and reasonable collection costs. After appropriate notice, Envolva may suspend or restrict access to Packages, Workspaces or Services while due amounts remain unpaid.

A suspension or restriction does not release the Customer from its payment obligation. Envolva lifts it once the outstanding amounts have been settled, provided that the contract has not ended and there are no other reasons for suspension.

10.6 Price Changes

Envolva may change prices for future Reporting Years. Envolva announces a price change in text form at least six weeks before the renewal date. The Customer can then cancel the renewal until the renewal date (section 11.3). The price of Reporting Years already paid does not change. Changes to statutory taxes, charges or comparable public levies may be taken into account independently to the extent they affect the service.

10.7 Employee Count and Upgrade

The price of a Package is based on the number of employees (FTE) the Customer stated when buying. Growth of up to 25 % is included in the price. If the number reported in the Workspace is more than 25 % higher and the annual price rises as a result, Envolva may lock downloads until the Customer has paid the difference in the annual price. The renewal date stays the same. For more than 1,000 employees, Envolva prepares a personal offer.

10.8 Package Changes

The Customer can enlarge its Package during the Service Period, for example by adding an Extension or by moving from Sustainability Report Basic to Sustainability Report Comprehensive. Envolva then charges the difference in the annual prices; there is no pro rata calculation for the remaining time. The renewal date stays the same. A reduction of the Package takes effect on the next renewal date.

11. Term, Renewal and Cancellation

11.1 Reporting Year and Service Period

With a Package, the Customer buys a Reporting Year. The Customer can work on it for twelve months from the purchase ("Service Period"). The Service Period ends on the renewal date shown in the Workspace. Envolva sells Reporting Years, not time: a Customer who finishes early receives no credit.

11.2 Automatic Renewal

Unless the Customer cancels, the Package renews on the renewal date on the agreed terms: the Customer buys the next Reporting Year, and Envolva sets up a new Workspace for it. Envolva reminds the Customer by email before the renewal date.

• With card payment, the payment provider charges the card on the renewal date; the new Reporting Year then opens.
• With payment on invoice, the Customer receives the renewal invoice on the renewal date. The new Reporting Year opens once the payment has been received. If another invoice of the Customer is still unpaid, Envolva issues the renewal invoice only after that invoice has been settled.

After a renewal, the previous Reporting Year stays open so that the Customer can complete it. Envolva archives it once its GHG Report is signed; a Reporting Year without a GHG Report stays open. Two Reporting Years can therefore run side by side.

11.3 Cancellation

The Customer can cancel the renewal until the renewal date, in the Workspace with "Cancel renewal" or in text form to info@envolva.de. The Customer keeps access until the end of the Service Period. Until the renewal date, the Customer can withdraw the cancellation in the Workspace.

Envolva can cancel the renewal in text form no later than one month before the renewal date.

11.4 Early Renewal

The Customer can buy the next Reporting Year before the renewal date ("Renew now"). The Customer pays the full price of the Reporting Year; Envolva does not credit remaining time and does not prorate. The new Service Period starts with the purchase and lasts twelve months.

• With card payment, the payment provider charges the card at once; the new Reporting Year opens once the payment is confirmed.
• With payment on invoice, the Customer receives the invoice at once; the new Reporting Year opens once the payment has been received.

The previous Reporting Year stays open under section 11.2. In particular, an early renewal is not possible if the Package has been cancelled, a Workspace for the next Reporting Year already exists, a Package change is scheduled, or another invoice of the Customer is unpaid.

11.5 Extraordinary Termination

The right to extraordinary termination for good cause remains unaffected. Good cause exists in particular if a party materially breaches essential contractual obligations and does not remedy the breach despite a reasonable grace period, if the Customer is in default with significant payments, if use is unlawful or endangers security, or if continuation of the contract is unreasonable.

11.6 Consequences of the End

If a Package ends without renewal, Envolva archives the Reporting Year at the end of the paid Service Period. There is no extra time. The archived Workspace is read-only; the finished Files are available on the archive page under section 8.4. After that, Envolva provides no further services for this Reporting Year, including no support, no expert sessions and no audit.

If the Customer has another running Package, it can request that an archived Reporting Year be reopened for 14 days. Envolva decides on the request.

Payment claims already accrued remain unaffected. Envolva refunds nothing for unused time unless the law mandatorily requires a refund.

11.7 Continuing Provisions

Provisions that by their nature are intended to continue beyond contract end remain effective. These include in particular payment claims, confidentiality, data protection, intellectual property, liability, compliance, final provisions and provisions on data retention or data deletion.

12. Intellectual Property

12.1 Rights in Envolva, Software and Materials

All rights in Envolva, the software, platform, user interface, workflows, data models, designs, source code, databases, documentation, methods, templates, texts, trademarks, logos, product names, know-how and other materials of Envolva remain with Envolva or the respective rights holders.

12.2 Rights in Standards, Templates and Methodology

To the extent Envolva maps standards, frameworks, taxonomies, templates, report structures, methodological notes or external references, the Customer does not acquire rights in these external standards or in Envolva's implementation. Use is limited to the agreed SaaS access.

The Customer is responsible for complying with any separate terms of use, license terms or access requirements of external standards, taxonomies, portals or recipients to the extent they apply outside the Envolva Services.

12.3 Customer Feedback

The Customer may provide Envolva with feedback, ideas, improvement suggestions or notes. Envolva may use such feedback free of charge to improve, further develop and market the Services without disclosing confidential Customer Data or transferring the Customer's rights in Customer Data.

12.4 Customer Data Remains Customer Property

As between Envolva and the Customer, Customer Data remains assigned to the Customer. Envolva uses Customer Data only within the scope of these GTC, the data protection agreements and the agreed Services.

12.5 No Transfer of Source Code or Platform Rights

The Customer has no claim to the release of source code, database structures, system architecture, internal algorithms, models, prompt logic, operating documentation or other internal platform components unless expressly agreed.

12.6 Text Suggestions

Envolva claims no rights in Text Suggestions that the Customer adopts. Envolva does not warrant that such texts are eligible for copyright protection.

13. Product Improvement and Anonymized Analyses

13.1 Use of Anonymized Usage Data

Envolva may use anonymized or aggregated usage, performance, error, security and product data to operate, secure, analyze, improve and further develop the Services. Such data must not allow conclusions to be drawn about individual customers, Users or confidential Customer Data.

Identifiable Customer Data is not used to train publicly available foundation models without a separate legal basis or express agreement. Data protection rules remain unaffected.

13.2 Product Improvement

Envolva may use insights from support cases, usage behavior, error patterns, performance data, customer feedback and general product metrics to improve functions, workflows, validations, exports, documentation and security measures.

13.3 Benchmarking Only Anonymized

Benchmarking, comparative values or aggregated analyses may be performed only in anonymized form or aggregated in such a way that individual customers or confidential Customer Data are not identifiable, unless the Customer has expressly consented.

13.4 No Disclosure of Confidential Customer Data

Envolva will not disclose confidential Customer Data for marketing, reference, benchmarking or product communication purposes unless the Customer has expressly consented or there is a legal obligation.

14. Confidentiality

14.1 Confidential Information

Confidential information is all non-public information of a party that, by its nature or the circumstances of disclosure, is to be regarded as confidential, in particular trade secrets, technical information, Customer Data, prices, contract content, product plans, security information, access credentials, reports, financial data and internal documents.

14.2 Protection Obligations

The receiving party protects confidential information with at least reasonable care and uses it only to perform the contract. It makes confidential information available only to persons who need it to perform the contract and who are bound by confidentiality obligations.

14.3 Permitted Disclosure

Disclosure is permitted to the extent necessary for performance of the contract, to affiliated companies, advisors, lawyers, tax advisors, payment service providers, processors, the Independent Auditors or other authorized recipients, provided that appropriate confidentiality or data protection obligations exist.

14.4 Exceptions

Information is not confidential if it is publicly known without breach of contract, was already lawfully known to the receiving party, was independently developed, or must be disclosed due to statutory, governmental or court order.

14.5 Duration of Confidentiality

The confidentiality obligations continue during the contract term and for five years after contract end. For trade secrets, the obligations continue for as long as the information remains a trade secret.

15. Data Protection

15.1 Roles Under the GDPR

The data protection roles depend on the specific processing. To the extent Envolva processes personal data on behalf of the Customer, the Customer is the controller and Envolva is the processor. To the extent Envolva processes personal data for its own purposes, Envolva is an independent controller.

15.2 Data Processing Agreement

To the extent required, the parties enter into a data processing agreement pursuant to Article 28 GDPR. The Customer is responsible for checking before using the Services whether such an agreement is required and for accepting the provided data protection documents.

In the event of contradictions between these GTC and an effectively concluded data processing agreement, the data processing agreement takes precedence for the processing of personal data.

15.3 Technical and Organizational Measures

Envolva implements appropriate technical and organizational measures to protect personal data. The measures may change due to technical, organizational or security-related development, provided that the level of protection is not unreasonably reduced.

15.4 Sub-processors

Envolva may use sub-processors to the extent necessary to provide the Services and provided that data protection requirements are met. These include providers of AI models and text recognition. Details and the list of sub-processors are set out in the data processing agreement, the privacy policy or the data protection information provided from time to time. The data processing agreement also sets out the data protection role of the Independent Auditors.

To the extent a data processing agreement provides for a list, information or objection procedure for sub-processors, those rules take precedence.

15.5 Data Subject Rights and Security Incidents

The parties support each other to the legally required extent in handling data subject rights, data protection requests, security incidents and regulatory requirements. The Customer remains responsible for the substantive response to requests to the extent it is the controller.

15.6 Access by Envolva and the Independent Auditors

Envolva staff can access Workspaces for support and operations, including by switching into a User's view. The Independent Auditors access the Workspace to audit the GHG Report. Envolva limits this access to what support, operations and the audit require.

16. Warranty

16.1 SaaS Performance According to Agreed Scope

Envolva warrants that the Services substantially correspond to the agreed scope of services. An immaterial deviation, temporary disruption, usual technical limitation or impairment caused by the Customer, third parties or force majeure does not give rise to warranty rights.

16.2 No Guarantee of Specific Reporting Results

Envolva does not guarantee specific reporting results, emissions values, scope classifications, economic benefits, regulatory results, audit results, customer ratings, bank decisions, funding decisions, tender successes or other external results.

16.3 No Guarantee of External Audit or Certification

Envolva does not guarantee external certification, verification, governmental acceptance, platform acceptance or confirmation by third parties. For the audit under section 3.6, Envolva owes the audit process, not a particular audit result and not the signature. Validation and review functions of the software do not create such a guarantee.

16.4 Cure

In the event of material defects in the agreed SaaS service, Envolva will, at its option, remedy the defect, provide a workaround, provide a replacement function or perform the service again, to the extent technically and economically reasonable.

Mandatory legal rights of the Customer remain unaffected. The Customer must report defects in a comprehensible manner and give Envolva an appropriate opportunity to examine and cure them.

16.5 Exclusion for Incorrect Customer Data or Misuse

Warranty rights do not exist to the extent a problem is based on incorrect, incomplete, outdated or unlawful Customer Data, AI suggestions adopted without review, insufficient cooperation, incorrect operation, the Customer's IT environment, unsupported browsers, unauthorized use, third-party provider issues or changes made by the Customer.

17. Liability

17.1 Unlimited Liability

Envolva is liable without limitation for intent and gross negligence, injury to life, body or health, under the German Product Liability Act, fraudulent concealment of a defect and expressly assumed guarantees, in each case to the extent legally mandatory.

17.2 Limitation of Liability

In the event of slightly negligent breach of essential contractual obligations, Envolva is liable only for the typical, foreseeable damage under the contract. Essential contractual obligations are obligations whose fulfillment is necessary for the proper performance of the contract and on whose compliance the Customer may regularly rely.

In all other respects, Envolva's liability for slight negligence is excluded to the extent permitted by law.

17.3 Exclusion of Indirect Damages

To the extent permitted by law, Envolva is not liable for indirect damages, lost profits, unrealized savings, reputational damage, business interruptions, data resulting from incorrect Customer inputs, external rejection of reports or other consequential damages, unless a case of unlimited liability under section 17.1 applies.

17.4 Liability for Free or Demo Services

For free, demo, test, beta or pilot services, Envolva is liable only in accordance with mandatory statutory provisions and, to the extent permitted, only for intent and gross negligence.

17.5 Liability for Data Loss

In the event of data loss, Envolva is liable, to the extent permitted by law, only for the restoration effort that would have been required if the Customer had properly and regularly backed up data or used the provided export and backup options. This limitation does not apply in cases of unlimited liability under section 17.1.

17.6 Independent Auditors

The Independent Auditors are themselves responsible for their audit and their signature (section 3.6). Envolva is liable for the careful selection of the auditors and for the audit process in the software working as described; sections 17.1 to 17.5 apply.

18. Force Majeure

18.1 Events Outside Reasonable Control

Neither party is liable for delays or non-performance to the extent caused by events outside its reasonable control. These include in particular natural events, war, terrorism, unrest, pandemics, labor disputes, power outages, internet outages, data center failures, attacks on IT systems, governmental measures, changes in law or disruptions of External Services.

18.2 Suspension of Performance

For the duration of a force majeure event, the affected performance obligations are suspended to the extent performance is impossible or unreasonably impeded as a result. The affected party informs the other party appropriately about the nature and expected duration of the disruption to the extent possible.

18.3 Termination Right in the Event of Longer Disruption

If a force majeure event lasts longer than sixty days and continuation of the contract is unreasonable for a party, either party may terminate the affected part of the contract with appropriate notice.

19. Compliance, Sanctions and Export Control

19.1 Compliance with Applicable Laws

The parties comply with the applicable laws. The Customer is in particular responsible for not using the Services for unlawful, sanctioned, fraudulent, misleading, discriminatory, abusive or security-endangering purposes.

19.2 Sanctions Lists and Embargoes

The Customer represents that, to its knowledge, neither it nor its beneficial owners are listed on relevant sanctions lists and that it does not use the Services in a manner that violates embargoes, sanctions or export control requirements.

19.3 Prohibition of Unauthorized Transfer

The Customer must not transfer the Services, access credentials, results, software components or technical information to persons, organizations, countries or recipients if this violates sanctions, export control law, data protection law, third-party rights or contractual restrictions.

19.4 Cooperation in Compliance Checks

Upon reasonable request, the Customer provides information that Envolva needs to check legal, regulatory, security-related or contractual compliance requirements. Envolva may refuse, suspend or terminate services to the extent necessary to comply with such requirements.

20. Final Provisions

20.1 Entire Agreement

These GTC, the order summary in the checkout or the accepted offer, prior-ranking individual agreements, order confirmations, the data processing agreement, the Terms of Use and other expressly incorporated documents constitute the agreement between the parties regarding the respective subject matter of the contract.

20.2 Changes to the GTC

Envolva may amend these GTC with effect for the future if legal, technical, economic, product-related or organizational developments require it. Every version carries a version number and a date; Envolva stores which version the Customer accepted.

Envolva announces a change in text form at least six weeks before it takes effect. For a running Reporting Year, the new version applies only from the next renewal; with the renewal or a new purchase, the Customer accepts the version then current. If the Customer does not want to accept the new version, it can cancel the renewal until the renewal date (section 11.3).

20.3 Electronic Communication

Contract-related communication may take place electronically, in particular by email, via the Workspace, via the customer account, via billing systems or through other communication channels provided by Envolva. The Customer keeps its contact details up to date.

20.4 Assignment

The Customer may assign or transfer rights and obligations under the contract only with Envolva's prior consent unless consent is not required by law. Envolva may transfer rights and obligations to affiliated companies or legal successors to the extent legitimate interests of the Customer are not unreasonably impaired.

20.5 Subcontracting

Envolva may use subcontractors and service providers to the extent necessary to provide, maintain, secure, bill, support or further develop the Services. Data protection requirements remain unaffected.

20.6 Severability

If any provision of these GTC is or becomes invalid or unenforceable, the validity of the remaining provisions remains unaffected. The statutory rule applies in place of the invalid or unenforceable provision. To the extent necessary, the parties will agree on a valid provision that comes as close as possible to the economic purpose of the original provision.

20.7 Applicable Law

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods and conflict-of-law provisions to the extent their exclusion is permissible.

20.8 Place of Jurisdiction

To the extent the Customer is a merchant, a legal entity under public law or a special fund under public law, the exclusive place of jurisdiction for all disputes arising out of or in connection with the contract is Hanover. Envolva is entitled to sue the Customer also at the Customer's general place of jurisdiction.

20.9 Language

These GTC exist in German and in English. The German version prevails. The English version is a translation for information only.