togethr - General Terms and Conditions

1. Scope, Provider

1.1 These General Terms and Conditions govern the use of the togethr platform, hereinafter referred to as the “Platform”, by business users and - where indicated - also consumer users, collectively referred to as “Customers”. The operator and contracting party is:

1.2 Any deviating terms and conditions of the Customer shall not apply unless the operator expressly agrees to their validity in writing.

1.3 The Platform is primarily aimed at B2B Customers, such as organisers/workspaces. Where services are offered to consumers, the information in Section 15 and - where applicable - the cancellation policy, Annex W, shall also apply.

2. Definitions

Workspace:

Customer tenant for managing events and user roles, OWNER/ADMIN/MEMBER.

Event:

Photo experience configured by the Customer with upload functionality.

Visitors:

Persons who upload images as part of an Event and personalise them with overlays/masks and optional text fields.

Plans:

FREE/PRO/BUSINESS with usage-based limits.

Generated Results/Overlays:

Output files generated by the system “on the fly” from the upload and not stored persistently.

3. Service Description

3.1 The Platform enables the creation and management of Events, the upload of images by Visitors and their immediate output with overlays/masks and optional text fields. Result images are generated temporarily and are not stored permanently. The original and a thumbnail of the upload are stored in cloud storage.

3.2 The Customer configures branding, such as banner/logo, Event visibility, including optional password protection, text fields and masks. The Platform provides server-side analytics at Event level, including visits, browser identifier, generated/loaded images, shares and session duration. IP addresses are stored exclusively in hashed form.

3.3 The operator provides Stripe Checkout for upgrades/renewals and paid custom overlay requests. For paid custom requests, a ClickUp ticket is created automatically.

3.4 The scope of functions may vary depending on the Plan. Limits are displayed in the account; when a limit is reached, Events may be deactivated automatically.

4. Registration, Account, Roles

4.1 An account is required for use as a Customer. Login details must be kept confidential.

4.2 The Customer manages roles, OWNER/ADMIN/MEMBER, for each Workspace and is responsible for internal permissions.

4.3 The Customer shall ensure that only authorised persons have access to Events and data.

5. Contract Conclusion, Term, Termination

5.1 The contract is concluded upon registration and/or booking of a paid Plan.

5.2 Unless otherwise stated, paid Plans run for the booked term and renew automatically unless terminated before expiry with effect from the end of the term.

5.3 Terminations may be made in the account or in text form. Statutory special termination rights remain unaffected.

5.4 After the end of the contract, Workspaces/Events will be deactivated; data will be deleted in accordance with Section 12 and the Privacy Policy.

6. Prices, Payments, Taxes

6.1 Prices are exclusive of statutory VAT, where applicable. The current prices and Plans are available at https://togethr-share.io/en .

6.2 Payments are processed via Stripe. The operator does not store complete payment details.

6.3 In the event of late payment, the operator may block access and claim default interest and reminder fees.

6.4 Upgrades are charged pro rata temporis; downgrades take effect from the next billing period.

7.1 Customer Obligations / Visitor Content

7.1 The Customer is responsible for the legality and content of its Events, including uploaded images, text fields, overlays and logos.

7.2 The Customer shall ensure that Visitors hold all necessary rights to their uploads, including copyright, trade mark, design, personality and image rights, and that they do not infringe any third-party rights or laws, such as data protection, youth protection or criminal law.

7.3 In particular, the following are prohibited: infringing, discriminatory, pornographic, violence-glorifying, extremist or otherwise unlawful content; content containing personal data subject to special protection, such as health data; and biometric analyses.

7.4 The operator is not obliged to review content in advance, but is entitled to block or delete unlawful content and deactivate Events where there are concrete indications.

8. Rights of Use

8.1 For the term of the contract, the Customer grants the operator the simple, non-transferable right to process, store, original/thumbnail, temporarily render and deliver via the Platform content uploaded by Visitors for the purpose of fulfilling the contract.

8.2 The Customer warrants that it is entitled to grant these rights.

9. Availability, Maintenance

9.1 The operator owes availability of the Platform appropriate to the Plan.

9.2 Maintenance work, updates and feature rollouts may lead to temporary impairments; scheduled maintenance will be announced in advance where possible.

9.3 Beta/experimental functions may differ or be discontinued at any time.

10. Warranty, Support

10.1 The Platform is provided in the latest version available at the time.

10.2 The Customer shall report disruptions without undue delay via the support channel.

10.3 The statutory defect rights apply to B2B Customers; there shall be no claim in the case of only insignificant deviations.

11. Liability

11.1 The operator shall be liable without limitation in cases of intent and gross negligence, for damages arising from injury to life, body or health, and under the Product Liability Act.

11.2 In cases of simple negligence, the operator shall only be liable for breach of a material contractual obligation, cardinal obligation, and the amount of liability shall be limited to the foreseeable damage typical for this type of contract at the time the contract was concluded.

11.3 The Customer shall be solely liable for content provided by the Customer or by Visitors.

12. Data Processing, Data Protection, Processing on Behalf

12.1 The operator processes personal data as a controller, such as account data and billing data, and - with regard to the processing of Event participant data - as a processor for the Customer.

12.2 The Data Processing Agreement, DPA, pursuant to Article 28 GDPR, Annex AV, forms part of these Terms and Conditions.

12.3 The Privacy Policy provides information about the nature, scope and purposes of the data processing; it is available at /en/datenschutz/ and attached as Section II.

12.4 Technical and organisational measures, TOMs, are described in Annex TOM.

13. Changes to Services/Terms and Conditions/Prices

13.1 The operator may adjust services where there are objective reasons for doing so, such as security, scalability or changes in the law.

13.2 Changes to the Terms and Conditions/prices shall be announced to the Customer in good time in text form. If the Customer does not object within the notified period, at least 30 days, the changes shall be deemed approved. In the event of an objection, the operator may terminate the contract as of the effective date of the change.

14. Export, Deletion, Return

14.1 During the term of the contract, the operator shall provide appropriate export functions for data held by the Customer.

14.2 After the end of the contract, personal data shall be deleted in accordance with the deletion periods, Section II/§7, unless statutory retention obligations apply.

14.3 Upon request, the operator shall confirm deletion in text form.

15. Consumer Information (where B2C applies)

15.1 Consumers may have a right of cancellation in distance contracts, Annex W. In the case of digital services, the right of cancellation may expire if the consumer expressly agrees that performance shall begin before the end of the cancellation period and confirms their knowledge that the right of cancellation will expire.

15.2 The EU ODR platform for dispute resolution: https://ec.europa.eu/consumers/odr/

16. Final Provisions

16.1 German law shall apply, excluding the UN Convention on Contracts for the International Sale of Goods. In relation to consumers, this shall apply only insofar as no mandatory consumer protection provisions of the country in which the consumer has their habitual residence conflict with it.

16.2 The place of jurisdiction for merchants shall be the operator’s registered office.

16.3 Should individual provisions be invalid, the validity of the remaining provisions shall remain unaffected.

Annex AV - Data Processing Agreement, Article 28 GDPR

(Part of the Terms and Conditions between Elephant Webdesign & Marketing GmbH, “Processor”, and the Customer, “Controller”, for the processing of Event participant data.)

§1 Subject Matter, Duration, Nature and Purpose of the Processing

The Processor provides the Controller with Platform services for carrying out Events: upload of original images, creation of thumbnails, temporary overlay creation and delivery, and server-side analytics at Event level.

Duration: For the term of the contract in accordance with the Terms and Conditions; after the end of the contract, deletion/return in accordance with §10.

Nature of the processing: Collection, storage, original/thumbnail, display/transmission, aggregation/statistics, deletion.

Purpose: Carrying out the Event, capacity management, abuse prevention, using hashed IP, and provision of usage statistics.

§2 Categories of Data Subjects and Types of Data

Data subjects: Event participants (Visitors); where applicable, employees of the Controller (Admins/Members) as part of Event configuration.

Types of data:

• Image data: Original, thumbnail (stored); overlays only temporary.
• Metadata/analytics: Hashed IP, browser identifier, session ID (random), timestamps, (visit, first/last download, exit), counters, shares, derived session duration.
• Text inputs for mask text fields.
• Log data (error/system logs) with pseudonymous IDs.

No biometric data; no facial analysis.

§3 Instructions

The Processor shall process data exclusively on documented instructions from the Controller (system configuration, API calls, admin settings.)

Verbal instructions must be confirmed promptly in writing (text form).

The Processor shall inform the Controller if it believes that an instruction infringes data protection law.

§4 Confidentiality

All persons employed by the Processor must be bound to confidentiality and data protection.

§5 Technical and Organisational Measures (TOMs)

The Processor has implemented the measures described in Annex TOM, including TLS, role-based access, bcrypt hashes, token-based processes, private buckets + signed URLs, IP hashing, backups/monitoring.

The Controller has the right to inspect the TOMs; material changes shall be documented.

§6 Sub-processors

The Controller grants authorisation for the use of the following sub-processors (list to be updated on an ongoing basis):

• Google Cloud Platform (Storage/Hosting) - Google Cloud EMEA Ltd. / Google LLC; storage of original images/thumbnails/logs.
• Stripe (payment processing) - Stripe Payments Europe Ltd. (and affiliated Stripe companies).
• Email/SMTP provider - Netcup (sending of transactional emails).
• ClickUp (ticketing for paid custom overlays) - Mango Technologies, Inc. ("ClickUp”).
• Google (OAuth) - Google LLC (login with “email”, “profile”).

The Processor shall ensure that Article 28(4) GDPR is complied with in relation to sub-processors (DPA/SCC).

Changes to the list shall be notified in text form; the Controller may object for good cause.

§7 Support Obligations

The Processor shall provide the Controller with reasonable support in fulfilling data subject rights, reporting/handling data protection breaches, data protection impact assessments and requests from supervisory authorities.

§8 International Data Transfers

Transfers to third countries shall only take place where the statutory requirements are met (in particular SCCs and supplementary safeguards). For details, see Section II/§5.

§9 Documentation Obligations, Audits

The Processor shall provide the information required to demonstrate compliance with the obligations under Article 28 GDPR.

Audits/inspections by the Controller or an appointed auditor are possible during business hours following reasonable prior notice; confidentiality and trade secrets must be protected.

The Processor may provide suitable evidence (such as certifications or reports), which may replace on-site audits.

§10 Deletion and Return of Data

Upon completion of the processing, the Processor shall delete the Controller’s personal data in accordance with the agreed storage periods and documentation obligations. Upon request, data shall first be provided in a commonly used format.

§11 Remuneration, Liability

Remuneration is governed by the Terms and Conditions/price lists.

Liability is governed by the Terms and Conditions; otherwise, the statutory provisions apply.

The Controller shall indemnify the Processor against claims arising from unlawful instructions, infringing content or missing authorisations.

§12 Final Provisions on the DPA

Side agreements must be made in text form. German law shall apply. Place of jurisdiction as set out in the Terms and Conditions.

Annex TOM - Technical and Organisational Measures (Excerpt)

• Access & identities: Role-based (OWNER/ADMIN/MEMBER), principle of least privilege; MFA optional/recommended.
• Cryptography: TLS in transit; passwords bcrypt; tokens time-limited (verification/reset 24 h, invitations 7 days); JWT with short lifetime.
• Storage & isolation: Private buckets in GCP with signed URLs; original/thumbnail stored; overlays not persistent.
• Logging/monitoring: Event and error logs; IP only hashed; aggregation at Event level.
• Backups/recovery: Database backups; restart processes tested.
• Development/secure defaults: Code reviews, secrets management, dependency management; no facial analysis active.
• Deletion & export: Processes for export/deletion; confirmation on request.
• Processors: DPAs/SCCs with sub-processors; transfers limited to what is necessary.

Annex W - Cancellation Policy

(Where the Platform is also aimed at consumers.)

Right of Cancellation

You have the right to cancel this contract within fourteen days without giving any reason.

The cancellation period is fourteen days from the day on which the contract is concluded.

To exercise your right of cancellation, you must inform us (Elephant Webdesign & Marketing GmbH, Schlosslände 26, 85049 Ingolstadt, hello@togethr-share.io) of your decision to cancel this contract by means of a clear statement (for example a letter sent by post, fax or email). You may use the attached model cancellation form for this purpose, but this is not mandatory.

To meet the cancellation deadline, it is sufficient for you to send the notification of exercising your right of cancellation before the cancellation period expires.

Consequences of Cancellation

If you cancel this contract, we shall reimburse you for all payments we have received from you, including delivery costs (except for any additional costs resulting from your choice of a delivery method other than the least expensive standard delivery offered by us), without undue delay and no later than fourteen days from the day on which we receive notification of your cancellation of this contract. For this reimbursement, we shall use the same means of payment that you used for the original transaction, unless expressly agreed otherwise with you; in no case will you be charged any fees for this reimbursement.

If you requested that the services begin during the cancellation period, you shall pay us a reasonable amount corresponding to the proportion of the services already provided up to the point at which you inform us of exercising your right of cancellation in relation to this contract, compared with the full scope of the services provided for in the contract.

Exclusion or Early Expiry of the Right of Cancellation

The right of cancellation expires early in the case of contracts for the supply of digital content if we have begun performance of the contract after you have expressly agreed that we may begin performance before the cancellation period expires and have confirmed your knowledge that, by giving your consent, you lose your right of cancellation once performance of the contract begins.

Model Cancellation Form

(Complete and return this form only if you wish to cancel the contract)