Allgemeine Geschäftsbedingungen (Terms of Service)

bitova GmbH · Samariterstraße 5 · 50968 Köln · Germany
Commercial register: Amtsgericht Köln, HRB 121944 · VAT ID: DE453535213
Managing directors: Ali Fallahi, Arian Ghahramani

Version 1.0 · valid from 14 November 2026

---

1. Scope

1.1 These Terms of Service ("Terms") govern the provision of the software-as-a-service product Maridex by bitova GmbH ("bitova") to its customers ("Customer"). Maridex consists of the web dashboard for the office, the desktop application Maridex Onboard for workstations on board, the server system operated by bitova for the Customer, and the AI assistant (together the "Service").

1.2 The Service is offered exclusively to entrepreneurs within the meaning of section 14 of the German Civil Code (BGB), legal entities under public law and special funds under public law. It is not offered to consumers.

1.3 These Terms apply exclusively. Terms and conditions of the Customer that deviate from, conflict with or supplement these Terms do not become part of the contract, even if bitova does not expressly object to them or performs without reservation.

1.4 The contract between bitova and the Customer ("Agreement") consists of the following documents. In case of conflict, they prevail in this order:

1. the Order Form signed by both parties, including any individual agreements in it;
2. the Data Processing Agreement (Annex 4), as far as the processing of personal data is concerned;
3. the Service Level Agreement (Annex 3);
4. the Service Description (Annex 2);
5. these Terms.

2. Conclusion of the Agreement; free trial

2.1 The Agreement is concluded when both parties have signed the Order Form, including electronically, or when bitova confirms in text form an order the Customer has placed in text form.

2.2 Free trial. Unless the Order Form provides otherwise, the Service is provided free of charge for the first 30 days after the Customer's system has been provided ("Trial"). The paid subscription begins on the day after the Trial ends. The Customer may terminate the Agreement in text form at any time during the Trial with effect from the end of the Trial; no fees are then payable.

2.3 During the Trial, bitova is liable only for intent and gross negligence; section 12.1 remains unaffected. If no paid subscription follows the Trial, bitova deletes the Customer's system and all Customer Data 30 days after the end of the Trial, unless the Customer requests an export (section 11) before then.

3. The Service

3.1 The content and scope of the Service are set out in the Service Description (Annex 2) and the plan chosen in the Order Form. The plan determines the maximum number of vessels for which the Service is used. Office users, onboard workstations, documents and revisions are not limited.

3.2 bitova operates a separate system for each customer (own server, network, database, file storage, keys and web address). It is hosted in a data centre in the European Union, by default in Germany.

3.3 The availability of the Service and bitova's support are governed by the Service Level Agreement (Annex 3).

3.4 Development of the Service. bitova develops the Service further and may change it, provided that the change is reasonable for the Customer, taking into account the interests of both parties, in particular because it

1. is required by changes in law, case law or regulatory requirements,
2. is needed to protect security, or
3. adds or improves functions without materially restricting the functions agreed.

bitova announces changes that materially restrict the use of the Service at least six weeks in advance in text form. The Customer may then terminate the Agreement with effect from the date the change takes effect.

3.5 The following are not part of the Service: the Customer's internet access, including the connectivity of the vessels; the Customer's hardware and operating systems; and the Customer's identity provider (Microsoft Entra ID).

3.6 Additional services, in particular bringing existing documents into Maridex ("Setup Service"), training and integrations, require a separate agreement. Unless otherwise agreed, they are services under section 611 BGB, not work under section 631 BGB.

4. Rights of use

4.1 For the term of the Agreement, bitova grants the Customer a simple (non-exclusive), non-transferable and non-sublicensable right to use the Service for the Customer's own business purposes. The right covers the vessels managed by the Customer within the limit of its plan, and the companies of the Customer's group named in the Order Form.

4.2 The Customer may install Maridex Onboard on any number of workstations on board the vessels covered by its plan. Crew members and the Customer's office staff may use the Service as authorised users ("Users").

4.3 The Customer shall not:

1. make the Service available to third parties other than Users, or operate it for third parties;
2. decompile, disassemble or otherwise reverse engineer the software, except as permitted by section 69e of the German Copyright Act (UrhG);
3. circumvent security or access controls, or test the Service for vulnerabilities without bitova's prior consent in text form;
4. use the Service to develop a competing product.

4.4 More vessels. If the Customer uses the Service for more vessels than its plan covers, bitova will inform the Customer. From the following calendar month, the plan that covers the actual number of vessels applies, unless the Customer reduces the number of vessels within 14 days of being informed.

5. Customer Data

5.1 All documents, files, metadata and other content that the Customer or its Users enter into the Service ("Customer Data") remain the Customer's property. The Customer grants bitova the rights needed to store, process, index, convert for preview, distribute to the vessels and process with the AI service listed in the Data Processing Agreement, solely to provide the Service.

5.2 bitova does not use Customer Data to train AI models, and does not allow its sub-processors to do so.

5.3 The Customer is responsible for the content of Customer Data. In particular, it is responsible for having the rights needed to use it in the Service, and for its lawfulness.

5.4 bitova may collect and use technical operating data that contains neither Customer Data nor personal data. Examples are load, response times, error rates and the number of documents. bitova uses this data to operate, secure and improve the Service.

6. The AI assistant

6.1 The assistant answers questions only from the Customer's documents in the Service. It has no access to the internet and states its sources. The documents it uses on board are limited to those the vessel receives. If the documents do not contain an answer, the assistant is designed to say so.

6.2 The answers are generated automatically. Despite these measures, they may be incomplete, inaccurate or cite the wrong passage. The assistant helps to find information in the documents. It does not replace the documents themselves, the Customer's safety management system or the judgement of the master, the crew and the office. In emergencies and for safety-critical decisions, the issued documents and the procedures of the safety management system prevail.

6.3 The Customer informs its Users of sections 6.1 and 6.2.

6.4 The AI service used is listed in the Data Processing Agreement. If the Order Form provides that the assistant uses an AI provider or account of the Customer ("Own AI Provider"), then:

1. the Customer is responsible for its contract with that provider and for the provider's processing;
2. bitova does not warrant the quality of the answers with that provider's models.

7. Distribution to the vessels; document control

7.1 Maridex distributes the current revisions of the documents to the workstations on board. The workstations receive them when they connect to the Customer's system. Delivery therefore depends on the vessels' connectivity. The fleet overview shows, for each vessel and workstation, which state it has reached.

7.2 The Customer remains responsible for its document control and for complying with its safety management system and with the International Safety Management (ISM) Code, in particular section 11. It is the Customer's responsibility to check that the vessels have received the current revisions, and whether Maridex's records replace any other acknowledgement under its safety management system.

8. Obligations of the Customer

8.1 The Customer provides the system requirements set out in the Service Description, including internet access for the office and the vessels.

8.2 The Customer shall:

1. assign roles to Users, keep access data confidential, and use multi-factor authentication in its identity provider for office Users with editing or administration rights;
2. approve an onboard workstation only after comparing the pairing code shown on board;
3. disconnect lost, sold or decommissioned workstations in the dashboard without delay.

8.3 The Customer is responsible for the conduct of its Users as for its own. It informs bitova without undue delay if it suspects misuse of the Service or a security incident.

8.4 The Customer shall not use the Service for unlawful content or purposes, place excessive load on it (for example with automated mass requests outside documented interfaces), or introduce malicious code.

8.5 Sanctions. The Customer warrants that neither the Customer, nor its group companies named in the Order Form, nor the vessels for which it uses the Service, are subject to sanctions of the European Union, the United Nations or the Federal Republic of Germany that prohibit the provision of the Service. The Customer informs bitova without undue delay if this changes.

9. Fees and payment

9.1 The fees follow from the Order Form and, failing that, from bitova's price list valid at the time of the order. All fees are net, plus statutory VAT. For customers in other EU member states, the reverse-charge procedure applies where its requirements are met.

9.2 Fees are invoiced monthly in advance and are payable within 14 days of the invoice date. Invoices are sent by email.

9.3 In case of late payment, statutory default interest applies (section 288 (2) BGB). If the Customer is more than 30 days in default with a due amount, bitova may suspend access to the Service in accordance with section 13.1 no. 3. It must first remind the Customer in text form and set a grace period of 14 days. The onboard workstations keep the documents already received.

9.4 Price changes. bitova may change the fees with effect from the beginning of a calendar month by notice in text form at least six weeks in advance. The Customer may then terminate the Agreement with effect from the date of the change. Fees agreed individually in the Order Form for a fixed period cannot be changed during that period.

9.5 The Customer may set off only claims that are undisputed or have been finally established by a court. This restriction does not apply to counterclaims from the same contractual relationship, in particular claims arising from defects.

10. Term and termination

10.1 The Agreement runs for an indefinite period, unless the Order Form agrees a minimum term.

10.2 The Customer may terminate the Agreement at any time with effect from the end of a calendar month; the notice must reach bitova before the end of that month. bitova may terminate the Agreement with three months' notice to the end of a calendar month.

10.3 The right of either party to terminate for good cause remains unaffected. Good cause for bitova exists in particular if:

1. the Customer is in default with fees for two consecutive months, or with an amount equal to two monthly fees;
2. the Customer seriously breaches section 4.3 or section 8.4, or continues another material breach despite a warning;
3. providing the Service would breach sanctions or export control law (section 8.5).

10.4 Notices of termination must be given in text form (for example by email).

11. Switching and exit

11.1 Switching. When the Agreement ends, the Customer may move to another provider or its own infrastructure, or have its data exported and deleted. bitova supports this as set out below. This section implements the obligations of a provider of data processing services under Chapter VI of Regulation (EU) 2023/2854 (Data Act).

11.2 Transitional period. At the Customer's request, made at the latest with its notice of termination, the Service remains available unchanged for a transitional period of up to 30 days after the end of the notice period. If this is technically not feasible, bitova informs the Customer within 14 working days of the request. In that case it may extend the period once, by up to seven months, giving reasons. No fees are charged for the transitional period. During the switch, bitova:

1. gives the Customer, and any new provider it names, reasonable assistance;
2. continues the Service with due care, so that the Customer's business can continue;
3. informs the Customer of known risks to that continuity.

11.3 Exportable data. At the Customer's request, bitova exports the following, free of charge, in a structured, commonly used and machine-readable format (ZIP archive with the files in their original format plus a JSON/CSV manifest):

1. all documents with all revisions, in the original file format;
2. their metadata (library, folder, code, title, revision number, effective date, change note);
3. the library and folder structure, the vessels, the users and their roles;
4. the audit log, including the hash of each entry.

11.4 Excluded from export. The following are not exported:

1. data that the Service derives from the documents and rebuilds automatically (search indexes, text extracts, vector embeddings, summaries);
2. technical logs and monitoring data;
3. security credentials and keys;
4. the chat histories in the dashboard.

11.5 Retrieval period and deletion. The Customer can retrieve its data for at least 30 days after the end of the transitional period, or, if there is none, after the end of the Agreement. bitova then deletes the Customer's entire system, including the database, the stored files and the backups, within a further 30 days, and confirms the deletion in text form. Statutory retention obligations remain unaffected.

11.6 After the system is deleted, the onboard workstations can no longer connect. The Customer removes Maridex Onboard, and with it the local copies of the documents, from its workstations.

11.7 bitova does not charge for switching, export or deletion.

11.8 Information on the jurisdiction of the infrastructure used for the Service, and on the measures against unlawful access by governments outside the EU, is available at https://docs.maridex.app/security/data-act/.

12. Liability

12.1 bitova is liable without limitation:

1. for intent and gross negligence;
2. for injury to life, body or health;
3. under the German Product Liability Act;
4. within the scope of a guarantee it has given;
5. for fraudulently concealed defects.

12.2 In case of slight negligence, bitova is liable only for breaches of material contractual obligations. These are obligations whose fulfilment makes the proper performance of the Agreement possible in the first place, and on whose observance the Customer may regularly rely ("cardinal obligations"). In that case, liability is limited to the foreseeable damage typical for this type of contract. Per contract year, it is limited to the fees payable for the three months before the damaging event.

12.3 For the loss of data, bitova is liable within the limits of sections 12.1 and 12.2 only for the effort needed to restore it from the backups that bitova must keep under the Service Description.

12.4 Strict liability for defects already present when the Agreement is concluded (section 536a (1), first alternative, BGB) is excluded.

12.5 Claims under section 12.2 become time-barred one year after the start of the statutory limitation period.

12.6 These limitations also apply to the personal liability of bitova's employees, representatives and vicarious agents.

12.7 Liability towards data subjects under Article 82 GDPR is not affected by this section.

13. Suspension

13.1 bitova may temporarily suspend access to the Service, in whole or in part, if:

1. a specific security risk to the Service or to Customer Data makes this necessary;
2. there are concrete indications that the Service is being used unlawfully;
3. the requirements of section 9.3 are met.

13.2 bitova chooses the least intrusive measure, informs the Customer without undue delay, and lifts the suspension as soon as the reason has ceased. Documents already on the onboard workstations remain readable.

14. Defects

14.1 The provision of the Service is governed by the law of rental contracts (sections 535 et seq. BGB), unless these Terms provide otherwise. bitova maintains the Service in the agreed condition for the term of the Agreement.

14.2 The Customer reports defects without undue delay in text form, with a description that allows them to be reproduced. bitova remedies defects within a reasonable period. The response times in the Service Level Agreement apply.

14.3 The Customer's right to reduce the fees remains unaffected. Service credits under the Service Level Agreement are offset against a reduction for the same period.

14.4 The Customer may terminate for failure to grant use (section 543 (2) no. 1 BGB) only if bitova has had sufficient opportunity to remedy the defect and has failed.

15. Confidentiality

15.1 The parties keep confidential all information about the other party that is marked as confidential or recognisably confidential, and use it only to perform the Agreement. This obligation continues for five years after the end of the Agreement. Customer Data remains confidential without time limit.

15.2 The obligation does not apply to information that:

1. is publicly known without a breach of this Agreement;
2. was already lawfully known to the receiving party;
3. was lawfully received from a third party;
4. must be disclosed by law or by order of a court or authority, in which case the other party is informed in advance where permitted.

15.3 bitova binds its employees and sub-processors to confidentiality to the same extent.

16. Data protection and information security

16.1 bitova processes personal data in the Customer Data on the Customer's behalf, under the Data Processing Agreement (Annex 4).

16.2 bitova is the controller for the personal data it processes to administer the contract, for invoicing, for support communication, and for checking licence numbers. The privacy policy at https://maridex.app/privacy applies.

16.3 bitova maintains the technical and organisational measures described in the Data Processing Agreement and adapts them to the state of the art.

16.4 bitova supports the Customer reasonably where the Customer must ensure the security of its supply chain under Directive (EU) 2022/2555 (NIS 2) or the national law implementing it. Once per contract year, bitova answers a security questionnaire free of charge; further support is provided against reasonable remuneration.

17. Changes to these Terms

17.1 bitova may change these Terms with effect for the future where this is needed:

1. because of changes in law or case law;
2. to describe new functions of the Service;
3. to close a gap that arose after the Agreement was concluded.

Changes to the main obligations (scope of the Service, fees, term) require the Customer's express agreement; for price changes, section 9.4 applies.

17.2 bitova announces changes at least six weeks before they take effect, in text form, and shows what has changed. The changes are deemed accepted if the Customer does not object in text form before they take effect; bitova points this out in the announcement. If the Customer objects, the Agreement continues on the previous Terms. bitova may then terminate it in accordance with section 10.2.

18. Reference

bitova may name the Customer as a reference (name and logo) only with the Customer's prior consent in text form.

19. Force majeure

Neither party is liable for failure to perform as long as performance is prevented by circumstances beyond its reasonable control. Examples are natural disasters, war, pandemics, government measures, strikes outside the party's own business, or large-scale failures of public networks or energy supply. The affected party informs the other party without undue delay.

20. Final provisions

20.1 bitova may transfer the Agreement to a company affiliated with it within the meaning of sections 15 et seq. of the German Stock Corporation Act (AktG), or to an acquirer of the business operating Maridex. It must give at least six weeks' notice in text form. The Customer may then terminate the Agreement with effect from the date of the transfer. In all other cases, the transfer of the Agreement requires the other party's consent.

20.2 Amendments and supplements to the Agreement require text form. This also applies to any waiver of this text-form requirement. Individual agreements take precedence (section 305b BGB).

20.3 The Agreement is governed by the law of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG).

20.4 If the Customer is a merchant, a legal entity under public law or a special fund under public law, or has no general place of jurisdiction in Germany, the exclusive place of jurisdiction for all disputes arising from or in connection with the Agreement is Cologne, Germany. bitova may also sue the Customer at its general place of jurisdiction.

20.5 These Terms are drawn up in English. German legal terms given in brackets or italics determine the meaning of the English term they accompany.

20.6 If a provision of the Agreement is or becomes invalid, the remaining provisions stay in force.