Cakewalk Technology shall provide the Customer with the “Professional” plan of the application Cakewalk (“Application”). The Application is provided as software-as-a-service.

Cakewalk will continue to develop the Application and provide updates, upgrades, and other further developments. This does not constitute a claim for the development of individual versions or the provision of new versions. However, customers are explicitly invited to submit feature requests and contribute to Cakewalk’s product roadmap.

The customer gets the Professional Plan at a special discount: EUR xxx per year (fixed price for unlimited users during the contract term). Additionally, the customer receives x extra months of free product usage. The ongoing fees for the Application are billed annually upfront / upfront for the entire xx-month term. Any additional seats over Z seats are billed quarterly in arrears at a price of A per user per month.

Summary of the discounts granted:

xxx

xxx.

xxx.

All prices quoted by Cakewalk Technology or listed in the Contract are stated without value added tax. If VAT is payable, the statutory VAT applicable at the time of delivery shall be added to the net price shown.

All remunerations shall be due for payment within 14 days after invoicing, unless expressly agreed otherwise. After expiry of the payment period, the Customer shall be in default. Cakewalk Technology shall be entitled to charge interest on arrears from the date of default in the amount of the applicable default interest rate.

Cakewalk Technology shall provide the Customer with the invoice via Stripe.

The Customer may only offset uncontested or legally established claims and may only base a right of retention on uncontested or legally established claims.

Fees include one-time setup and onboarding services at the start of the subscription term and reflect discounts granted based on an annual commitment.

The Contract shall enter into force at signing date. The Contract shall have a minimum term of one (1) year (“Initial Term”) plus x extra free month starting xxx and ending xxx.

The right to extraordinary termination remains unaffected. Notices of termination must be declared in text form, email being sufficient.

Date for the provision of the Application ("Provision Date"): With signature date.

The place of performance for the provision of the Application shall be the location of the servers operating the Application. In all other respects, Cakewalk Technology shall provide the contractual services at the registered office of Cakewalk Technology.

Cakewalk Technology shall ensure that the actual availability of the Application will not be less than 99.5 % per year (“Availability”), measured on a monthly basis and excluding planned maintenance work. If Availability in a calendar month falls below the agreed threshold, the Customer is entitled to a service credit equal to 10% of the monthly-equivalent fee (annual fee divided by 12), applied to the next invoice.

Cakewalk Technology shall be entitled to carry out regular maintenance work ("Planned Maintenance Work") but shall try to keep the interruptions of the agreed availability time as low as possible. Cakewalk Technology will inform about Planned Maintenance Work at least 7 days before the start of the maintenance work. Planned Maintenance Work is not considered when calculating downtime with respect to Availability.

Cakewalk Technology will respond to standard support requests within 4 business hours and to critical requests within 30 minutes during business hours. Business hours are Monday to Friday, 08:30–18:00 UK local time (GMT or BST, as applicable).

Cakewalk Technology shall be entitled at any time to further develop the functionalities of the Application ("Modifications"). Cakewalk Technology shall inform the Customer about Modifications within a reasonable period of time. Modifications shall be communicated to the Customer either by e-mail, within the Application or by any other means of communication chosen by Cakewalk Technology. If, as a result of the Modification, the Application cannot be used by the Customer for the contractually agreed or assumed purposes, or can only be used by the Customer with material restriction, the Customer shall have a special right of termination.

Cakewalk Technology grants the Customer the non-exclusive right to use the Application for its own business purposes for the duration of the Contract as software-as-a-service.

The Customer is not allowed to copy, translate, disassemble, decompile, reverse engineer or otherwise modify the Application, in whole or in part.

Cakewalk shall indemnify, defend, and hold Customer harmless from and against any third-party claim alleging that Customer’s authorized use of the Services infringes any valid intellectual property right, provided that Customer promptly notifies Cakewalk of the claim and cooperates in the defense.

Cakewalk Technology shall remain the owner of all intellectual property rights in the Application and the results of other services. All intellectual property rights associated with or embodied in or resulting from the Application ("New Rights") shall belong exclusively to Cakewalk Technology. This shall also apply if New Rights are based on suggestions, specifications, feedback, requirements, ideas, contributions, comments or other input of the Customer, the users or third parties. New Rights do not include data of the Customer that is processed via the Application. Unless otherwise agreed, in relation to Cakewalk Technology, the Customer shall exclusively be entitled to all rights in and in relation to the aforementioned Customer data.

Cakewalk Technology processes usage data and technical metadata generated through the Customer’s and its users’ interaction with the Application (“Usage Data”). Usage Data may include information about user interactions, technical events and other data generated during the use of the Application. Cakewalk Technology uses this data to improve the performance, security and usability of the Application, and provide customer support. All processing of Usage Data is carried out in accordance with applicable data protection laws, including the General Data Protection Regulation, and subject to appropriate technical and organizational measures ensuring confidentiality, integrity and security. For the avoidance of doubt: No personal data is used for AI training purposes.

In all cases of termination of the Contract - for whatever legal reason - the Customer is obliged to immediately stop using and accessing the Application.

The Customer shall cooperate in the performance of the contractual obligations to the extent necessary and free of charge. In particular, the Customer shall provide Cakewalk Technology with information and documents required for the performance of the services, which Cakewalk Technology requires for the execution of the Contract.

The assessment as to whether the applications meet the Customer's requirements and can be used for the Customer's economic purposes is the sole responsibility of the Customer.

The Customer shall take reasonable precautions for the event that the Application does not function or does not function properly. The Customer is solely responsible for the regular and complete backup of its business-relevant data and documents.

Cakewalk Technology is entitled to mention the Customer by name on its website and in further marketing activities. Also, the Customer will record a customer success story with Cakewalk Technology.

All information on the services shall not constitute a guarantee for the quality of the services, unless a guarantee has been expressly agreed in writing. A certain quality of the services cannot be derived from advertising materials, which are not specifically included as an attachment to this Contract.

Cakewalk Technology shall be liable without limitation for (i) intent or gross negligence, or (ii) in the event of injury to life, body, or health or (iii) insofar as Cakewalk Technology has assumed a guarantee. Liability under the Product Liability Act shall also remain unaffected. In all other events, the liability for damages and reimbursement of wasted expenditures shall be limited to EUR 10,000.00 or the value of the previous twelve (12) month’s fees paid, whichever is higher, and, in the event of data loss, Cakewalk Technology shall only reimburse the costs of recovery up to the amount that would have been incurred for the recovery of the data if it had been properly and regularly backed up.

The Customer may be given the option to access beta features, which are provided “as is”. Cakewalk shall not be liable for any damages or issues arising from features labelled as beta.

Insofar as liability is excluded or limited according to this section, this exclusion or limitation shall also apply to the personal liability of the legal representatives, employees and vicarious agents (“Erfüllungsgehilfen”) of Cakewalk Technology and all subcontractors of Cakewalk Technology.

The Receiving Party (defined below) may use Confidential Information of the Disclosing Party (defined below) only for the performance of contractual obligations or - to the extent necessary for this purpose - for the utilization of contractual services.

"Confidential Information" means information as defined in the sentence 2, which is disclosed by one Party ("Disclosing Party") to the other Party ("Receiving Party") or otherwise becomes known to the Receiving Party in the course of the project, irrespective of whether disclosed directly or indirectly in writing, orally or through the viewing of items before or after the signing of the Contract, and whether or not it is the subject of intellectual property. Confidential Information includes (i) prices and terms under this Contract, marketing strategies, financial information or projections, sales estimates, and business plans, (ii) plans for products or services, (iii) inventions, new designs, processes, formulas, or technologies, (iv) work in process, source code, (v) any other information designated as confidential or obviously identifiable as confidential information of the Disclosing Party.

However, Confidential Information shall not include any information that the Receiving Party can demonstrate (i) was publicly known and generally available prior to the time of disclosure by the Disclosing Party, (ii) becomes publicly known and generally available after disclosure by the Disclosing Party to the Receiving Party without any action or inaction by the Receiving Party, (iii) was already in the Receiving Party's possession at the time of disclosure by the Disclosing Party, (iv) was obtained by the Receiving Party from a third-party without breach of a confidentiality obligation, or (v) was independently developed by the Receiving Party without reference to or use of the Disclosing Party's Confidential Information.

In the event that Confidential Information is required to be disclosed due to an order by a public authority or a court or due to a legal obligation, the Receiving Party shall disclose only such Confidential Information that is necessary to comply with the obligation and shall promptly notify the Disclosing Party as soon as and to the extent permitted by law. The Parties shall assist each other, to the extent legally possible, in avoiding disclosure.

The Receiving Party shall treat all Confidential Information as strictly confidential and shall exercise a reasonable degree of care, but not less than the degree of care it exercises to protect its own Confidential Information. The Receiving Party shall not disclose any Confidential Information received by it to any third-party (except as otherwise provided in this Contract). Each Party shall be responsible for any breach of this Contract by its managing directors (“Geschäftsführer”), executive staff, employees, agents, or representatives ("Representatives"), regardless of whether the respective Representatives were authorized to receive such information under this Contract.

Furthermore, the Parties undertake to comply with the applicable provisions of data protection law. In addition, to the extent that the services constitute commissioned processing within the meaning of Article 28 of the General Data Protection Regulation, the data processing agreement ("DPA”) shall apply.

In the event that the Contract between the Parties is terminated - for whatever legal reason - those provisions shall continue to apply which, according to their meaning and purpose, would justify their continued application even after termination of the mutual obligations to perform. This includes in particular the following regulatory areas of this Contract:

Should one or more provisions of the Contract be or become ineffective for any reason whatsoever or should there be gaps in the provisions of this Contract, this shall not affect the validity of the remaining provisions of the Contract.

The Contract shall be governed by German law to the exclusion of the United Nations Convention on Contracts for the International Sale of Goods (CISG). The conflict of law provisions shall not apply. The exclusive place of jurisdiction for all disputes in connection with this Contract shall be the registered office of Cakewalk Technology.

Subject matter

Term

The data processing under this DPA shall in principle be carried out within the European Union or the European Economic Area. Any processing in a third country shall only take place if the requirements of Article 44 et seq. GDPR are fulfilled.

For transfers of Personal Data outside the EEA, the Parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2 – Controller to Processor) shall apply.

Nature and purpose of the intended processing of data

Type of data and categories of data subjects

The Processor shall establish security pursuant to Articles 28 (3) (c) and 32 GDPR, in particular in connection with Article 5 (1), (2) GDPR. The Processor is ISO 27001:2022 certified and complies with the resulting requirements.

The Processor has documented the implementation of the required technical and organizational measures before the start of the processing, in particular with regard to the specific execution of the DPA in Annex 2. The Controller agrees with the measures listed in Annex 2 and has accepted them as appropriate. Insofar as the inspection/audit of the Controller reveals a need for adaptation, the necessary adaptations shall be implemented amicably.

The technical and organizational measures are subject to technical progress and further development. In this respect, the Processor shall be permitted to implement alternative adequate measures. In doing so, the security level of the specified measures must not be undercut. Significant changes shall be documented.

Processing of data by employees of the Processor outside the Processor's premises (mobile working) is permitted. The Controller acknowledges that in these cases the technical and organizational measures described in Annex 2 do not fully fit. However, the Processor warrants that it shall also take appropriate technical and organizational measures for the data processing under this DPA outside its own business premises. The Processor shall present the company's own guideline on mobile working to the Controller at the latter's request.

In addition to compliance with the provisions of this DPA, the Processor has statutory obligations pursuant to Articles 28 to 33 of the GDPR; in this respect, the Processor shall in particular ensure compliance with the following requirements:

When performing the processing, the Processor shall only employ employees who have been obligated to maintain confidentiality and who have previously been familiarized with the data protection provisions relevant to them.

The Controller and the Processor shall, upon request, cooperate with the supervisory authority in the performance of duties.

The Controller shall be informed without undue delay about control actions and measures of the supervisory authority, insofar as they relate to this DPA. This shall also apply insofar as a competent authority investigates in the context of administrative offense or criminal proceedings with regard to the processing of personal data within the framework of this DPA on the part of the Processor.

To the extent that the Controller is subject to an inspection by the supervisory authority, administrative or criminal proceedings, a liability claim of a data subject or a third party or any other claim in connection with the processing of personal data by the Processor on behalf of the Controller, the Processor shall support the Controller with best efforts.

The Processor shall regularly monitor the internal processes as well as the technical and organizational measures to ensure that the processing in the Processor's area of responsibility is carried out in accordance with the requirements of the applicable data protection law and that the protection of the rights of the data subjects is ensured.

The Processor shall support the Controller in complying with the obligations stipulated in Articles 32 to 36 of the GDPR regarding the security of personal data, data breach notification obligations, data protection impact assessments and prior consultations. This includes, but is not limited to the obligation to:

ensure data protection by technical and organizational measures that address the circumstances and purposes of the processing, as well as the predicted probability and severity of a potential security breach, and allow an immediate detection of relevant incidents (see ISO 27001:2022 certification);

report personal data breaches to the Controller based on the following triage categories:

Critical severity (actual or likely high risk to data subjects): notify within 12 hours.

High severity (potential but limited risk): notify within 24 hours.

Low severity (no expected risk to data subjects): notify within 72 hours.

to support the Controller within the fulfillment of Controller’s obligation to provide information to the data subject and to provide the Controller with all relevant information in this context without undue delay;

support the Controller in data protection impact assessments;

support the Controller in prior consultations with the supervisory authority.

For support services that are not agreed in the Main Contract or are due to misconduct by the Processor, the Processor may claim reasonable compensation, except for assistance required under Article 28(3) GDPR (breach notification, data subject rights, DPIA, and prior consultation), which shall be provided at no additional cost.

“Sub-Processors” within the meaning of this provision are service providers rendering services that relate directly to the performance of the main service under this DPA. Not covered by the term Sub-Processor are service providers providing ancillary services to the Processor, e.g. telecommunications services, mail/transport services, maintenance and user service or the disposal of data carriers as well as other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing systems. However, the Processor shall be obligated to implement appropriate and legally compliant contractual agreements as well as control measures to ensure data protection and data security of the Controller's data even in the case of outsourced ancillary services.

The Controller agrees to the commissioning of the Sub-Processors listed in Annex 3, provided that a contractual agreement is concluded between Processor and the respective Sub-Processor in accordance with Article 28 (2) to (4) of the GDPR.

The outsourcing of data processing to further Sub-Processors or the change of the commissioned Sub-Processors shall be permitted, provided that:

The Processor notifies the Controller of the outsourcing to Sub-Processors in writing or in text form within a reasonable period of time in advance and

the Controller does not object in writing and

a contractual agreement in accordance with Article 28 (2) to (4) of the GDPR is used as a contractual basis.

The objection according to Section 6.3.2. must be made within a period of one month after the information has been provided. In the event of an objection, the Controller shall bear the consequences (e.g. subjective impossibility of performance) and any additional costs resulting from the fact that the Sub-Processor cannot be commissioned. If the Processor cannot provide the service agreed in the Main Contract due to the objection or can only do so at economically unreasonable expense, the Processor shall have an extraordinary right of termination.

The transfer of personal data of the Controller to the Sub-Processor and the Sub-Processors initial engagement shall only be permitted after all requirements for the outsourcing of data processing to Sub-Processors have been met.

In the event that the Sub-Processor provides the agreed service outside the EU/EEA, the Processor shall ensure that the service provided by the Sub-Processor is compliant with data protection law by taking appropriate measures. The same shall apply in the event that service providers rendering ancillary services within the meaning of Section 6.1 shall be assigned.

Further outsourcing by the Sub-Processor is only permitted within the scope of the statutory provisions.

The Controller shall have the right, in consultation with the Processor, to carry out inspections at the Processor's business premises or to have inspections carried out by inspectors to be named in individual cases. The Controller shall have the right to convince itself of the Processor's compliance with this DPA in the Processor’s business premises during business hours by means of spot checks, which must be notified at least four weeks in advance. Such inspections shall take place no more than once a year.

The Processor shall ensure that the Controller can convince itself of the Processor's compliance with its obligations pursuant to Art. 28 of the GDPR. The Processor undertakes to provide the Controller with the necessary information upon request and, in particular, to provide evidence of the implementation of the contractually agreed technical and organizational measures.

The proof of those measures, not only relating to the specific data processing under this DPA, can be provided by

The Controller shall immediately confirm verbal instructions at least in text form (documented instruction). The Controller may not derive any claim from instructions that have not been confirmed in text form in due time.

The Processor shall notify the Controller in the event that the Processor is of the opinion that an instruction violates data protection regulations. The Processor shall be entitled to suspend the execution of the relevant instruction until the instruction has been confirmed or amended by the Controller.

The Processor shall be obliged to treat as confidential all knowledge of personal data, business secrets and data security measures of the Controller obtained within the framework of the contractual relationship.

Copies or duplicates of the data shall not be created without the knowledge of the Controller. This shall not apply to backup copies to the extent that they are required to ensure proper data processing as well as data processing that is required to comply with statutory retention obligations. In addition to that, the Processor is ISO 27001:2022 certified and complies with the resulting data retention requirements.

After completion of the contractually agreed services or earlier upon request by the Controller - at the latest upon termination of the Main Contract - the Processor shall be obliged to return to the Controller or, after prior consent, destroy in accordance with data protection law all documents, processing and utilization results created, as well as data files related to the contractual relationship that have come into its possession. The same shall apply to test and reject material. The record of erasure shall be submitted upon request.

Documentation which serves as proof of the proper data processing in accordance with this DPA shall be kept by the Processor beyond the term of the DPA in accordance with the respective retention periods. The Processor may hand them over to the Controller at the end of the term of the DPA to relieve the Processor.

In the event that claims for damages within the meaning of Article 82 of the GDPR, fines within the meaning of Article 83 of the GDPR and/or other sanctions within the meaning of Article 84 of the GDPR are threatened or imposed against a Party in connection with the processing activities covered by this DPA, that respective Party shall inform the other Party thereof in text form without undue delay. The Controller and Processor are obliged to support each other in the defense against the aforementioned claims.

The Controller and the Processor shall be liable for the data processing in the external relationship in accordance with the relevant laws.

The provisions of this DPA shall only apply to the processing of personal data pursuant to Article 28 GDPR and take precedence over any conflicting or deviating provisions from the Main Contract to this extent.

All amendments to this DPA must be made in writing. This shall also apply to any amendment of this written form clause. The written form may also be complied with by means of an exchange of letters (with the exception of notices of termination) or by means of electronically transmitted signatures (fax, transmission of scanned signatures via email). However, Section 127 (2) and (3) German Civil Code (“BGB”) shall not apply in all other respects.