Terms of use of StepOver International GmbH, Otto-Hirsch-Bruecken 17, 70329 Stuttgart, Germany

hereafter: Operator

for network-based signature services

Section 1 Subject matter of the contract

(1) The Operator provides the Customer with an internet platform, known as webSignatureOffice, which the Customer can use to upload, view and electronically sign PDF documents. The documents can also be signed electronically by customers of the Customer. Certificates are produced using the platform, which certify the electronic signing of a document, the identification of the signatory of the document, and verify that the document has not been altered following the signature.

(2) webSignatureOffice supports two types of electronic signatures; the digital handwritten electronic signature, for which the biometric data of the signature can be tested by a handwriting expert in cases of doubt, and the certificate-based digital signature. The certificates produced by webSignatureOffice are software certificates, i.e. the signatory does not require a smart card or card reader to use the digital signature.

(3) Neither of the signature types provided by webSignatureOffice fall within the scope of qualified e-signatures (with smart card and card reader). Rather, these are simple or advanced e-signatures, in accordance with the EU Directive on electronic signatures. As such, webSignatureOffice does not fulfil the requirements for a trust centre for qualified e-signatures (e.g. as per the German Digital Signature Act). Simple and advanced e-signatures are a means of proof of appearance, i.e. the judge must test the validity of the e-signature in cases of doubt (in contrast to qualified e-signatures, there is no presumption of security for such signatures).

(4) The certificates generated by webSignatureOffice are encrypted with the password of the user’s account, and are stored on the webSignatureOffice servers.  However, the user’s password is not stored there.

(5) The Operator is entitled to expand its services, to adapt to technological advances, and/or to adopt improvements. This is particularly applicable where the adaptation appears to be necessary in order to prevent abuse, or where the Operator is obliged to adapt services due to legal requirements.

(6) If the Operator provides additional services without requesting additional payment, the Customer has no claim for performance for delivery of the services. The Operator is entitled to cease, alter or to request payment for such services provided free of charge. In such instances, the Operator will inform the customers in a timely manner.

(7) The Operator is obliged to provide technical support to the Customer, solely within the scope of the contractual agreement. In addition, the Operator grants no free support services to the customer. The Operator provides no direct support for customers of the Customer, provided that no other written agreements have been made.

Section 2 Agreed data volumes

The Operator provides an upper data storage limit of 250 MB. If this limit is exceeded, the Customer can no longer upload or prepare further PDF documents or other data on the signature server until the Customer has freed disk space by downloading or deleting documents and data.

Section 3 Operational area

The geographic operational area of webSignatureOffice is exclusively the EU and Switzerland. Users who access webSignatureOffice from outside of this area are required to ensure that use of webSignatureOffice complies with any existing laws in the relevant region/country, with regard to use of encryption software, e-signatures, patents, and also with any other rights, regulations and laws. The Operator takes no responsibility for this matter.

Section 4 Obligations of the Customer

(1) The Customer ensures that all information provided by themselves is correct and complete. The Customer is obliged to keep contact data in their user profile up-to-date, and is aware that the validity and applicability of the signature certificate significantly depends upon its accuracy.

(2) The Customer shall provide daily updated security copies of all data transferred to webSignatureOffice, which will not be stored on the webSignatureOffice servers themselves, and which will ensure a swift and cost-effective reproduction of data in the event of a system failure. In the event of a loss of data, the Customer shall re-upload the affected data to webSignatureOffice free of charge, and shall restore configurations as necessary.

(3) The Customer is obliged to regularly change passwords used for the purposes of access to webSignatureOffice, and to keep these strictly confidential. The Customer shall inform the Operator immediately if third-party knowledge of the password becomes apparent.

(4) The Customer shall report any defects immediately to the Operator, and in the event of defect removal by staff, will support this process, in particular by taking all possible measures for data security.

(5) Furthermore, the Customer is obliged not to use webSignatureOffice for activities which contravene legal restrictions, which are contra bonos mores, or which contravene the rights of third parties. In particular, this applies to the following activities:

(a) Distribution of harmful software

(b) Sending of e-mails to third parties for advertising purposes, where the recipient has not specifically given consent for this, or where no permission has been granted;

(c) Manipulation in any form of webSignatureOffice and/or the software running on it.

(6) In cases where the Customer controvenes one or more of the stated obligations, the Operator is entitled to cease providing all services with immediate effect. Claims for damages are expressly reserved.

(7) If the customer receives a document signed with webSignatureOffice where the selected signature method of the signatory is not sufficient, the Customer should ask for a signature using a more secure method, or for a paper signature. In addition, the Customer should check the document for its completeness, correct presentation and validity of signature, e.g. by using the free Acrobat Reader.

Section 5 Remuneration

(1) The Customer is not required to pay either a registration fee or a basic fee to participate in webSignatureOffice.

(2) For the performance of actions which are subject to a charge, the Customer requires credits, which may only be obtained through the webSignatureOffice website, and which must be purchased in advance. The Operator is entitled to engage external payment service providers.

(3) Credits purchased by the Customer have an unlimited validity, but cannot, however, be exchanged for cash.

(4) A valid invoice is produced by the Operator for the Customer, in electronic form. In cases where the Operator offers optional postal delivery of an invoice, the Operator can demand payment in the form of credits. The cost of the payment will be shown to the customer when activating the postal delivery services.

Section 6 Guarantee and responsibility

(1) The Operator indicates that, based on the current status of technology, it is not possible to produce hardware and software which is free of defects in all combinations of application, or which can be protected from all forms of manipulation by third parties. The Operator does not guarantee that the service provided will be sufficient for the Customer, nor that it is appropriate for specific applications, nor that it is crash-, error- or virus-free. The Operator only guarantees the customer that the service provided works correctly at the time of transfer, under normal operating conditions and with normal levels of maintenance.

(2) The webSignatureOffice server location is within the EU. The Operator does not guarantee continuous accessibility to the server, as faults can occur which do not lie within their responsibility (for instance, acts of God, interruption of electrical supplies or internet connection to the data centre, etc.).

(3) In case of intent and gross negligence, the Operator shall be liable according to the legal regulations.

(4) The Operator is only liable for slight negligence in cases of violation of a significant contractual obligation, the fulfilment of which makes it possible to properly execute the contract, and where the Customer may regularly trust in compliance with this obligation (cardinal obligation). In these cases, the Operator is liable only to the extent of the foreseeable, typical damage.

(5)  In cases of slight negligence, any liability for all other damages, in particular consequential damages, indirect damages or losses of profit, is excluded.

(6) Existing restrictions do not apply in cases of violations of life, body or health, nor for liability according to the Product Liability Act.

(7) Where the liability of the Operator is excluded or restricted, this also applies for the liability of employees, other members of staff, representatives and subcontractors of the Operator.

(8) Furthermore, the Operator is not liable for damages to the Customer which concern a violation of the obligations stated in Section 5.

(9) The Customer is aware that simple and advanced electronic signatures are valued as proof of appearance in each individual case by a court, on the basis of the circumstances, and a portion of the value of a digital signature is dependent upon the identification data used to generate the certificate.

A certificate which, for example, has been generated to identify a person using the ‘Postident’ method, offers a significantly better possibility of identifying the signatory in cases of dispute, compared to a certificate only connected with an e-mail address. A further security factor is the protection of the platform from unauthorised use by third parties.

 A signature which can be triggered by input of a simple (weak) password is, in cases of doubt, more refutable than a signature, the application of which required both a password and the input of a changing character string (e.g. a TAN), which was the best way to deliver to the signatory via another communications channel (e.g. post, SMS etc.).

(10) The customer is aware that there are types of contracts which cannot be signed using either a simple or an advanced electronic signature. In Switzerland, Germany and Austria, these include, for example, all contracts which require written form, e.g. sales of land, etc.

Section 7 Data protection

(1) Duty of customer information for webSignatureOffice

Below we want to inform about the ascertainment of personal data by our product named webSignatureOffice. Personal data is all data, which can be related to a person, e.g. name, address, email address, telephone number etc. The Operator acquires, processes and uses customers’ personal data in accordance with the legal data protection provisions. In addition to this, webSignatureOffice also logs any signing in and out and the activities of the logged-in user(s) within the application and for purposes, among other things, of accounting, statistics and the verifiability of the operations (e.g. on creating an audit trail/operation tracking in the framework of signature services) as well as for product optimization. The operator stores so called session cookies on the computer of the users for e.g. checking if the user is logged in. The operator may use permanent cookies. Furthermore, the operator uses cookies of third parties service providers to analyze data in compressed form.

(2) The purpose of processing the data and its legal basis

The data is collected, saved and passed on if necessary to allow to keep records and protocol circumstances (“Audit Trail”), to upload documents to the platform, sign them and share them with other users and to contact these users (“Send contact request”) as well as to link data to digital information, with which one can identify the location, the date, the signer or respectively the signature creator and to verify the integrity of the signed digital information (“digital signature”). Furthermore, the data is used for accounting purposes and to create invoices in case of purchases or contracts liable to payment in the context of webSignatureOffice. Therefore, collecting, saving and handling the data is done with the purpose of fulfilling a contract based on article 6, paragraph 1, sentence 1, letter b GDPR. Not providing this data can lead to the consequence of not being able to perform the services. Further processing is only done with your agreement or if a legal permission is available. To some extent we are using external service providers based in the European economic region in order to process your data and to provide the technical support and respectively the operations of webSignatureOffice.com. These service providers have been selected by us carefully, contracted by us in written form and are bound to our instructions. They are regularly controlled by us. The service providers will not pass on this data to any third party but will delete it after fulfilling the contract and at the end of the legally imposed time limits for data storage, if you did not agree to any data storage beyond these limits. We maintain technical measures to ensure the protection of personal data. These measures are adjusted to the current state of the art.

(3) Use of user data for electronic signatures.
For each user account (dedicated user accounts) the address, name, email and further contact data such as the mobile phone number of the user may be stored in the webSignatureOffice system. The system will use them to create a digital signature certificate that contains the user information (Name, Address, eMail, Mobile phone number) to allow the user to sign documents digitally (click to sign method) with this certificate. By doing so, the certificate will be used to sign the document and the certificate and the contained user data will be part of the signed document and will be readable for every receiver of the signed document.

(4) Use of biometric data
In case of a handwritten signatures the signature image as well as the X,Y coordinates and the according time data will be captured. If available, the pressure will be captured as well along with the X,Y and time values. This data is called the “biometric data”. The biometric data will be highly encrypted (hybrid asymmetric and symmetric encryption) and linked to the hash value of the signed document before it will be saved inside the document as “Handwritten e-Signature”. In order to decrypt the biometric data (for example to compare the signature by a handwriting expert with other signatures to prove it’s validity) a private RSA key is required. This key is stored by a notary and will only be used for decryption of the biometric data in case of a dispute (for example on request of a court) to enable a handwriting expert to compare the signature with other samples. In such a case the biometric data will be transferred from the notary to the handwriting expert for his examination and deleted afterwards. Decryption procedures are documented by the notary.

(5) Encryption
webSignatureOffice uses encryption algorithms and key lengths which correspond to the respective security requirements at the time of use. The algorithms and key lengths used were based on the recommendations of the Federal Office for Information Security (BSI) of the Federal Republic of Germany. With increasing computing power and the introduction of new technologies, encryption methods that are regarded as secure today can become insecure over time, and the recipients/keepers of electronically signed documents must themselves ensure that they are stored appropriately secured and audit-proofed.

(6) Payments with PayPal

webSignatureOffice uses the online payment service PayPal.

PayPal is operated in Europe by PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

You can find PayPal's current privacy policy here: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

We use this payment service provider on the basis of Art. 6 para. 1 sentence 1 lit. b) GDPR to fulfil the purchase contracts concluded within webSignatureOffice and to pursue our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.

The payment service provider processes all data necessary for the processing of the payment and purchase process; these are in particular your name, address, bank data and information regarding the purchased goods. This information is required to carry out the transactions.

It is possible for the payment service provider to transmit your data to credit agencies for identity or credit checks. For further information and the use of third-party companies, please refer to their General Terms and Conditions and Privacy Policy.

(7) Data storage time periods

If we do not process your contact data for operational purposes, we save the data, which has been collected for webSignatureOffice until the expiration of the time limit of at most 6 months after your deregistration or respectively after deleting your user account. We store data collected for invoices until the expiration of a 10 year time limit. We store information about the contractional relationship required by commercial law and taxation law up to the legally imposed time limits according to article 6, paragraph 1, sentence 1, letter c GDPR.
During this time period, the data will only be processed again in case of an examination by fiscal authorities. After the expiration of this time limit, the data collected for invoices will be deleted or the access to them will be blocked if deletion is not possible.

(8) Google Analytics

We use Google Analytics on our website. This is a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as "Google". We process data with the help of Google Analytics for the purpose of optimising our website and for marketing purposes on the basis of your consent pursuant to Art. 6 (1) lit. a. DSGVO. Usage and user-related information, such as IP address, location, time or frequency of visits to our website, is transferred to a Google server in the USA and stored there. The data collected in this way is in turn used by Google to provide us with an evaluation of the visit to our website and the usage activities there. This data may also be used to provide other services related to the use of our website and the use of the internet. Google states that it will not associate your IP address with any other data. Google also provides further information on data protection at: https://www.google.com/intl/de/policies/privacy/partners Google also provides you with further information on data protection law, including information on how to prevent the use of your data. The concrete storage period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the data protection declaration for Google Analytics: https://policies.google.com/privacy. In addition, Google offers a so-called deactivation add-on at https://tools.google.com/dlpage/gaoptout?hl=de offers a so-called deactivation add-on together with further information on this. This add-on can be installed with the usual Internet browsers and offers you further control over the data that Google collects when you call up our website. The add-on informs the JavaScript (ga.js) of Google Analytics that information about your visit to our website should not be transmitted to Google Analytics. However, this does not prevent information from being transmitted to us or to other web analytics services. Of course, you can also find out whether and which other web analytics services we use in this privacy policy.

(9) Google AdWords with conversion tracking

In our website, we use the advertising component Google AdWords and the so-called conversion tracking. This is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as "Google". We process your data with the help of Google Ads for the purpose of optimising our website and for marketing purposes on the basis of your consent pursuant to Art. 6 para. 1 lit. a. DSGVO. If you click on an ad placed by Google, the conversion tracking we use saves a cookie on your terminal device. These so-called conversion cookies lose their validity after 30 days and do not serve to identify you personally. If the cookie is still valid and you visit a specific page of our website, both we and Google can evaluate the fact that you have clicked on one of our advertisements placed with Google and that you have subsequently been redirected to our website. Google uses the information obtained in this way to create statistics for us about visits to our website. In addition, this provides us with information about the number of users who clicked on our ad(s) and about the pages of our website that were subsequently accessed. However, neither we nor third parties who also use Google AdWords are able to identify you in this way. You can also prevent or restrict the installation of cookies using the appropriate settings in your internet browser. At the same time, you can delete cookies already stored at any time. However, the steps and measures required for this depend on the specific internet browser you use. If you have any questions, please use the help function or documentation of your Internet browser or contact its manufacturer or support. Furthermore, Google also offers the following services at:
https://services.google.com/sitestats/de.html
https://www.google.com/policies/technologies/ads/
http://www.google.de/policies/privacy/

Google also offers further information on this topic and in particular on the possibilities of preventing the use of data.

(10) Qualified Electronic Signature

For the service of the Qualified Electronic Signature (QES) we use the following sub-processors:

(11) Your data privacy rights

At all times you are entitled to request disclosure of all your personal data (Article 15 GDPR), which has been collected by us. This also extends to the recipients or the categories of recipients, to which this data has been passed on as well as the purpose of saving the data. Furthermore, you have the right to rectification corresponding to the conditions of article 16 GDPR and/or the right to erasure corresponding to the conditions of article 17 GDPR and/or the right to restriction of processing corresponding to article 18 GDBR. Additionally, you always have the right to demand a transfer of information corresponding to the conditions of article 20 GDPR – provided the data is still stored by us. If personal data is processed in order to perform a task carried out in public interest (article 6, paragraph 1, sentence 1, letter e GDPR) or for the purpose of legitimate interests (article 6, paragraph 1, sentence 1, letter f GRPR) you always have the right to object to the prospective processing of your personal data. In case of your objection, we are obliged to refrain from processing your data any further for the aforementioned purposes, unless…
– there are any compelling reasons requiring protection, which override your interests, fundamental rights and freedoms, or
– processing is required for the enforcement, exertion or defense of legal claims.
On the conditions of article 21, paragraph 1 GDPR you have the right to object to processing your personal data on grounds relating to your particular situation at any time.

(12) Contact
Responsible under the terms of article 4, paragraph 7 GDPR is:

StepOver International GmbH
Otto-Hirsch-Brücken 17
70329 Stuttgart

Please send all requests for information or disclosure as well as all revocations or objections to data processing either per email to our data protection commissioner at DataProtection@stepover.com or per letter to the address written in subitem 1. For further information, we refer to the complete text of the GDPR, which is available on the internet at https://gdpr-info.eu and to our data privacy statement, which is available on the internet at www.webSignatureOffice.com.
Furthermore, you have the possibility to file a complaint at the responsible controlling authority about data protection issues. The contact data for the responsible controlling authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit
Dr. Stefan Brink
Postfach 10 29 32
70025 Stuttgart
Germany

or:

Königstraße 10a
70173 Stuttgart
Germany

(13) The Operator expressly refers the Customer to the fact that data protection cannot be comprehensively guaranteed in accordance with the most recent technology within open networks such as the internet, and therefore also in webSignatureOffice. The Customer knows that the Operator can view the data saved in webSignatureOffice from a technical perspective. Other participants online may technically be able, without authority, to access the network security system or infiltrate the server and monitor data traffic / view the data / copy the data. The Customer is entirely responsible for the safety and assurance of the data he transfers and stores. The Customer must bear the responsibility that he correspondingly makes copies of his data and documents. The Customer must absolutely not leave his signed documents on the server for longer than necessary but download these as quickly as possible and archive them.

(14) Privacy statement
 In addition to this declaration here our general data privacy statement applies, which you can read at any time in the Privacy Policy section at www.webSignatureOffice.com

Section 8 Publishing information and data for reviewingsignatures in the event of a dispute

In the event of a dispute, the Operator will provide to the enquiring court or other reviewing entity the required records, documents and information regarding the disputed process and the certificates as well as the recorded identifiers of the undersigner concerned, or provide the handwriting expert with the recorded biometric data of the handwritten signature of the undersigner, in as far as the Operator is still able to attach this; the Operator does not provide any guarantee for this. In particular, signed documents are not archived by the Operator. The user himself is absolutely and solely responsible for this. In this, the Customer agrees to accept these conditions. Furtheromre, the Operator will guarantee access to all the available information regarding the structure and the functionality of the system as well as, if necessary, the source texts, in order to enable the court or the reviewing entity to perform a comprehensive review.

In order to also be able to serve these review queries after the deletion of the user account, the Operator is entitled to to continue to store the certificate created for the Customer and the personal data provided by the Customer at the time of its creation (such as addresses), on the basis of which the certificate was generated.

Section 9 Copyrights, license agreements

(1) The Operator grants the Customer a non-exclusive (simple) usage right on the in-house and third-party software provided without any temporal or other restriction. Transfering this, or granting sub-licenses to third-parties, is not permitted, unless the Operator’s consent is issued by means of novation.

(2) In as far as licensing provisions from other software manufacturers or OpenSource programmes must be taken into consideration, this is displayed to the Customer when the application is installed or started, or the Operator will separately indicate to the Customer its validity and the Customer’s obligation to adhere to this.

(3) For applications from the Apple App Store, the standard App Store licensing conditions apply or, if in existence, the specifically deviating conditions of the respective software.

Section 10 Exemption

The Customer is obligated to exempt the Operator in their internal relationship from any kind of third-party claims that are based on illegal or illicit actions on the part of the Customer or content-related errors in the information provided by the Customer. This applies in particular for breaches of copyright, brand, name, data protection and competition rights.

Section 11 Contract formation, contract term, termination

(1)  The contract comes into effect through the acceptance of the contractual offer from the Customer on the part of the Operator. The acceptance is either declared expressly or should be stated in the initial phase of the performance of the contractual duties by the Operator.

(2)  The Customer does not require any notice of termination to end the contract. The Customer simply ceases using the software that is the subject of this contract. No refund will be given to the Customer for the credits obtained. The Customer account and all of the data, documents, invoices and credits contained therein will be deleted by the Operator at the earliest 1 year after the final time they are used.

(3) The Operator may give notice to the Customer with a term of 4 weeks. In cases where the Customer still holds credits at the time of cancellation, the Operator shall pay the attributable purchase price to the Customer on request, payable to a named bank account within the European Union or Switzerland. Where the Customer is a merchant, legal entity under public law or a public-law special fund, they must notify the Operator of their bank account within 6 months of the expiry of the notice period; otherwise, the Customer forfeits any remaining balance. Following receipt of the cancellation, the Operator shall inform the Customer of this disclosure requirement.

(4) The right of both parties to extraordinary termination for good reason remains unaffected. A good reason for the Operator is, in particular, where the Customer culpably breaches a material contractual obligation, and the customer does not take remedial action within an appropriate length of time, despite warning.

Section 12 Reservation of right of modification

The provisions of these Terms of Use may be changed, provided that these do not affect significant provisions of the contract, and that these changes are necessary to adapt to developments which were not foreseeable when concluding the contract, and where failure to consider these developments would disturb the balance of the contract considerably. Significant provisions are, in particular, those concerning type and scope of contractually agreed services, the duration, the unlimited validity of credits and the provisions concerning cancellation. Furthermore, adaptations or additions to the Terms of Use may be made, where these are necessary to eliminate difficulties in performing the contract, due to new loopholes which have been identified following conclusion of a contract. This can particularly be the case where the jurisdiction is amended, and where one or more clauses of the contract are affected by this.

(2) Proposed changes to these Terms of Use will be communicated to the Customer in written form (also via email) at least six weeks before becoming effective. The customer has a special right to cancellation at the point in time at which the changes become effective. In cases where the Customer still holds credits at the time of cancellation, the Operator shall pay the attributable purchase price to the Customer on request, payable to a named bank account within the European Union or Switzerland. If the Customer does not cancel in written form (or by email) within six weeks of communication of the change, the changes will become part of the contract at the point in time at which they become effective. The Customer will be made particularly aware of this consequence within the communication of the change.

Section 13 Others, Final Provisions

(1) All information and statements of the Operator can be directed to the Customer electronically, particularly via the contractual software itself, or via email to the email address supplied by the Customer.

(2) Deviating terms and conditions of the Customer shall not be accepted, unless it is expressly agreed in writing. These Terms of Use also apply if the services are rendered without reservation, when it is known that there are conflicting terms and conditions with those of the Customer.

(3) The law of the Federal Republic of Germany applies, to the exclusion of the CISG.

(4) In cases where the Customer is a merchant, legal entity under public law or a public-law special fund, Munich is the exclusive place of jurisdiction for all disputes from and in relation to the contractual relationship. In addition, the Operator is entitled to sue the Customer at their general place of jurisdiction.

(5) If a provision of the contract is or becomes ineffective, or if the contract contains a loophole, this does not affect the effectiveness of the other provisions. The parties are obliged to replace the ineffective provision with an effective provision, which corresponds to the business objective of the ineffective provision. The same applies in cases of a contractual loophole.

Effective 2019-11-19