General Terms and Conditions

(1) The provider of the SaaS platform Funnalized is Funnel-Link · Andrej Hirsch, Garmischer Straße 14, 82418 Murnau, Germany (hereinafter “Provider”).

(2) These Terms (Allgemeine Geschäftsbedingungen – AGB) apply to all contracts for the use of the Funnalized platform between the Provider and entrepreneurs within the meaning of § 14 BGB (“Customer”). The offer is aimed exclusively at entrepreneurs; the conclusion of a contract with consumers is excluded. Conflicting or deviating terms of the Customer do not become part of the contract unless the Provider expressly agrees to them in text form.

(1) The Provider makes Funnalized available to the Customer as software-as-a-service via the public internet. In the plans currently offered, the platform comprises all modules — including sales (CRM), recruiting (applicant management, careers pages, application funnels), marketing (campaigns, funnels), projects, team management and reporting; the plan booked in each case determines the scope of services, in particular the number of included workspaces and any additional services.

(2) The specific scope of functions and services results from the product description of the booked plan tier valid at the time of the order at funnalized.app/en/preise. The Provider continuously develops the platform; changes that do not significantly restrict the contractually agreed core functionality remain reserved.

(3) The platform is provided in the scope of functions made available in each case. A specific quality or suitability for a purpose assumed by the Customer that goes beyond the product description is only owed insofar as it has been expressly agreed in text form. Availability is governed by § 10.

(1) The contract is concluded upon registration of an account and confirmation of these Terms; paragraph 4 applies to the Customer’s users. The Customer warrants that it provides all information truthfully, acts as an entrepreneur and keeps access credentials secret. Access credentials in this sense are, in addition to the password, also the access to the accounts through which it and its users sign in (for example at Google, Microsoft, LinkedIn or Facebook or in the Customer’s directory for the company login), as well as the client secret stored for the company login and the access key of the automatic user provisioning (SCIM).

(2) Free trial period: Newly registered customers receive a free trial period of 14 days; accounts that are created in an existing workspace through invitation, company login or automatic user provisioning do not establish a trial period of their own. The trial period ends automatically and does not turn into a paid subscription without the active booking of a plan. After it expires, access to the workspace is restricted; the data remains available for export for 30 days, after which the Provider reserves the right to delete the workspace including all data. The Customer can itself request the deletion of its workspace in the application at any time; it is finally carried out after 30 days have elapsed and can be revoked by the Customer in the application until then. At the express request of the Customer in text form, the Provider also deletes before this period expires.

(3) Beta programme: For participants in the beta programme (“founder places”), the special conditions shown at the time of booking apply. The Customer acknowledges that the platform is under active development during the beta phase and that individual functions may be changed or replaced. Functions expressly marked as preview or beta are provided without an availability commitment under § 10 and may be changed or discontinued at any time.

(4) Users of the Customer: The Customer can give further persons access to its workspaces — by invitation, via the company login or via the automatic user provisioning of its directory (SCIM). These persons (“Users”) act on behalf of the Customer in relation to the Provider; no separate user agreement arises as a result. If a User confirms these Terms when accepting an invitation, they thereby undertake to comply with them when using the platform; the Customer remains the Provider’s contractual partner. The Customer ensures that its Users comply with these Terms and is answerable for their actions in its workspaces.

(5) Sign-in: In addition to email address and password, the Customer and its Users can, where offered, sign in with an account at Google, Microsoft or LinkedIn, provided that an account at Funnalized already exists for the email address confirmed by the respective service, and via Facebook, provided that the account has previously been linked to Facebook in the settings. No new account is created in the process. An activated second factor is required on every sign-in route; when signing in with a passkey, which every account can set up in the settings, the passkey itself provides it. In the relationship between User and service, the terms of the respective sign-in service apply; § 5a applies to the company login and the automatic user provisioning.

(1) For the term of the contract, the Provider grants the Customer the simple, non-exclusive, non-transferable and non-sublicensable right to use the Funnalized platform via the internet for its own business purposes to the extent of the booked plan (in particular with regard to the number of workspaces). The source code or the software itself is not provided.

(2) The Customer is not entitled to make the platform available for use to third parties outside its workspaces, whether against payment or free of charge, to reproduce it, to decompile it or to create derivative works, unless this is mandatorily permitted by law (§§ 69d, 69e of the German Copyright Act, Urheberrechtsgesetz – UrhG).

(3) Passing on to end customers (agency model): In derogation from paragraphs 1 and 2, the Customer is entitled to let its own end customers use the sub-workspaces created within its plan — also against payment — and to work on them together with them. The Customer alone remains the Provider’s contractual partner; it owes the remuneration for all workspaces it has created and is answerable for its end customers complying with these Terms. The Customer determines the fee it charges its end customers itself. The application itself remains under the Funnalized brand in any case; renaming or rebranding the application is not permitted. The Customer may operate the pages it publishes — in particular customer portal, careers pages, application funnels, marketing funnels and assessments — under its own brand and its own domain.

• The Customer is solely responsible for the content and data it processes in Funnalized, in particular for their lawfulness.
• The Customer is and remains the controller within the meaning of Art. 4(7) of the General Data Protection Regulation (Datenschutz-Grundverordnung – DSGVO; “GDPR”) for the personal data of its data subjects — in particular its customers, leads and applicants. It ensures that it has a legal basis for their processing and fulfils its own information and transparency obligations (Art. 13, 14 GDPR). In this respect, the Provider acts exclusively as a processor in accordance with the data processing agreement (Auftragsverarbeitungsvertrag – AVV; “DPA”).
• When sending emails via the platform, the Customer undertakes to comply with the applicable regulations (in particular § 7 of the Act against Unfair Competition, Gesetz gegen den unlauteren Wettbewerb – UWG, and the GDPR) and not to send any unlawful advertising or spam.
• The Customer does not use the platform abusively (e.g. automated crawling, overload attacks, reverse engineering, passing on access to unauthorised third parties).
• The Customer backs up the data it has exported on its own responsibility and reports security incidents in connection with its access credentials or the accounts through which it and its users sign in without delay.
• The Customer keeps its contact and billing data — in particular email address, address and stored means of payment — up to date during the term of the contract.

The above obligations to cooperate are genuine contractual obligations of the Customer. Additional effort demonstrably incurred by the Provider as a result of their breach may be charged to the Customer separately at rates communicated in advance in text form; further statutory claims remain unaffected.

(1) The Customer can set up sign-in for its workspace via its own directory (company login via OpenID Connect or SAML 2.0) and have users automatically created, changed and blocked from it (automatic user provisioning via SCIM). The company login only applies to email domains that the Customer has confirmed as its own by means of a DNS entry. If a person with an address from these domains signs in for the first time, the platform adds them to the workspace with the role chosen by the Customer, unless the Customer has switched this addition off.

(2) The Customer is responsible for setting up and securely operating its directory, for the accuracy of the persons kept there, for the role with which new users are added, and for withdrawing access from persons who have left. It only confirms domains that are at its disposal and removes the company login for a domain as soon as it no longer has that domain at its disposal; the Provider does not regularly re-check the confirmation. It keeps the client secret and the SCIM access key secret and replaces or revokes them without delay if misuse is suspected; it reports to the Provider without delay any security incident in its directory that may affect access to Funnalized.

(3) If the Customer requires the company login, sign-in with a password — including when accepting an invitation — and via Google, Microsoft, LinkedIn or Facebook is blocked for persons with an address from the confirmed domains; they sign in via its directory. This applies to their entire access to Funnalized, including to workspaces of other customers. The Customer ensures that it remains able to act if its directory fails, for example by means of an owner access with an address outside the confirmed domains.

(4) Regardless of whether the Customer requires the company login, the automatic user provisioning applies to every person with an address from its confirmed domains, even if they already have an account at Funnalized. Its directory can add them to its workspace and determine their name; the platform uses this name for their account as a whole, i.e. also in workspaces of other customers. If the directory blocks or removes a person, their membership in the Customer’s workspace is suspended and all their sessions end, including in workspaces of other customers; as long as the membership is suspended, they cannot sign in via its company login. Their account remains in existence.

(5) For users of the Customer whose address belongs to a domain that another customer — typically their employer — has confirmed for its company login, paragraphs 3 and 4 also apply in the Customer’s workspaces: if the other customer requires the company login, the sign-in routes mentioned in paragraph 3 are also blocked for them there. The other customer’s directory can determine their name and, by blocking or removing them, also end their sessions in the Customer’s workspaces, regardless of whether the other customer requires the company login. If it requires it, they can, as long as the block exists, sign in for the Customer’s workspaces neither via the routes mentioned in paragraph 3 nor via its company login.

(1) All rights to the data and content that the Customer or its users bring into Funnalized (“Customer Data”) remain with the Customer. For the term of the contract and until complete deletion pursuant to § 9(4), the Customer grants the Provider the simple rights of use that are technically necessary for operating the platform (in particular storing, reproducing for backups, displaying, transmitting within the scope of the functions and integrations activated by the Customer).

(2) The Customer indemnifies the Provider against all claims of third parties that are based on unlawful use of the platform by the Customer, on infringing content brought in by it or on a breach of data protection obligations by the Customer in handling the personal data it processes, including the reasonable costs of legal defence. This does not apply insofar as the Customer is not responsible for the infringement.

(3) The Provider uses Customer Data exclusively for the performance of the contract; use for its own advertising purposes or disclosure to third parties outside the recipients named in the privacy policy does not take place; transfers to systems that the Customer connects itself (such as integrations or its directory for the company login) take place on its instructions.

(4) Feedback and anonymised usage data: If the Customer or one of its users submits suggestions, ideas, requests for improvement or error reports concerning the platform to the Provider (“Feedback”), the Provider may use this Feedback free of charge and without limitation in time and space to improve and further develop its products; the Customer has no claim to implementation or to remuneration. The Provider may also use aggregated, fully anonymised usage data for the further development of the platform, for statistics and for capacity planning. Anonymised in this sense are only data that do not allow any conclusions to be drawn about the Customer, its end customers or individual data subjects; such data are not Customer Data within the meaning of paragraph 1. Otherwise, paragraph 3 remains unaffected.

(1) Insofar as the Customer processes personal data in Funnalized, the Customer is the controller and the Provider is the processor. For this purpose, the parties conclude the data processing agreement (DPA) pursuant to Art. 28 GDPR, which becomes part of this contract upon registration in electronic form (Art. 28(9) GDPR).

(2) The Provider processes this data exclusively on documented instructions from the Customer. The Customer alone is responsible for the permissibility of the processing, the existence of a legal basis and the fulfilment of data subject rights vis-à-vis its data subjects. The Provider is not liable for data protection violations resulting from the Customer’s handling of the data for which it is responsible; the statutory liability of the processor under Art. 82 GDPR for breach of its own obligations remains unaffected.

(3) The Provider provides the users’ accounts and their sign-in — with a password or via Google, Microsoft, LinkedIn or Facebook — under its own responsibility; this also includes the logs of sign-ins, including those via the company login, and the recording of sessions. The same applies to the security entries on the accounts (for example on sign-in, sign-out and password change) that the Provider keeps in the activity history of the workspace to which an account was first assigned; they are deleted together with this workspace. Details and periods are set out in the privacy policy (sections 4 and 8). By contrast, what the Provider takes over, creates, changes or blocks on the basis of the information in the Customer’s directory (company login, SCIM) is processed on the Customer’s behalf under the DPA.

(1) The remuneration is based on the selected plan tier in accordance with the price list valid at the time of booking. All prices are exclusive of statutory value added tax. For customers based outside Germany within the European Union, invoicing is carried out under the reverse-charge procedure if a valid VAT identification number is provided; the Customer notifies the Provider of its VAT identification number without being asked and keeps it up to date.

(2) Invoicing takes place in advance, monthly or annually depending on the payment interval selected at the time of booking (“billing period”), via the payment service provider Stripe. For annual payment, the annual price shown for this in the price list applies. Invoices are provided electronically.

(3) In the event of default in payment, the Provider is entitled to demand default interest of nine percentage points above the base interest rate (§ 288(2) BGB); the assertion of further damage caused by default remains reserved. After prior notice with a reasonable period, the Provider is further entitled to restrict access to the workspace to read-only access. In this state, the Customer’s data remains fully accessible to it: it can continue to view, evaluate and export it, make the outstanding payment and request the deletion of its data; changes and new entries are not possible. The restriction ends automatically as soon as the outstanding amounts have been received. The obligation to pay for the term of the contract remains unaffected by this.

(4) The Customer can only set off against claims of the Provider with undisputed or legally established counterclaims. The Customer is only entitled to a right of retention on account of counterclaims arising from the same contractual relationship.

(5) Price changes for existing customers are announced in text form at least six weeks before they take effect and only apply from the following renewal period. In the event of a price increase, the Customer has a special right of termination as of the time the increase takes effect.

(6) Founder conditions: For customers who have booked one of the limited founder places, the base price agreed at the time of booking remains unchanged for the duration of the uninterrupted contractual relationship; paragraph 5 does not apply to this base price. Prices for additionally booked workspaces and additional services remain unaffected by this commitment.

(1) The contract runs for the selected billing period (§ 8(2)) — one month or one year — and is automatically extended by a further billing period of the same length in each case unless it is terminated by the last day of the current billing period with effect from its end; there is no notice period. Access remains available in full until the end of the billing period. Termination can be declared at any time directly in the application (billing settings) or in text form. § 3(2) applies to the free trial period.

(2) The right to extraordinary termination for good cause remains unaffected. Good cause for the Provider exists in particular in the event of a serious or repeated breach of the obligations under § 5.

(3) Blocking as a milder means: If there are specific indications of a significant breach of the obligations under § 5, the Provider may temporarily block the Customer’s access or individual content, irrespective of the requirements of paragraph 2. The Provider informs the Customer without delay of the blocking and the reason for it and gives it the opportunity to comment. The blocking is lifted as soon as its reason no longer applies. For the duration of a justified block, the Customer’s obligation to pay remains in place.

(4) After the end of the contract, the Customer can export its data for 30 days; thereafter it is deleted in accordance with the DPA, unless statutory retention obligations exist.

(1) The Provider owes an availability of the platform of 99% on a monthly average, measured at the transfer point of the data centre; no guarantee in the legal sense is assumed thereby. In the calculation, times of announced maintenance, disruptions outside the Provider’s sphere of influence (force majeure, failures of network operators), interruptions caused by the Customer — including failures or misconfigurations of the directory connected by the Customer — and disruptions of the services through which users sign in are disregarded. The Customer’s statutory rights in respect of defects remain unaffected.

(2) Planned maintenance work is carried out in low-usage time windows wherever possible and announced in advance if an impairment is to be expected.

(3) Force majeure: Events of force majeure release the parties from the affected performance obligations for the duration of the disruption and to the extent of its effect. Force majeure means all circumstances beyond the will and influence of the parties that were not foreseeable when the contract was concluded and cannot be averted even with reasonable care — in particular natural events, war, terrorist attacks, epidemics and pandemics, industrial action including strikes and lawful lockouts, official orders, failures of power and telecommunications networks and large-scale disruptions at upstream suppliers or in the data centres used. The affected party informs the other party without delay of the occurrence and the expected duration of the disruption. If the disruption lasts longer than six weeks, each party is entitled to terminate the contract with immediate effect; the Provider reimburses remuneration already paid in advance for the unused period on a pro rata basis.

(1) The Provider is liable without limitation in the event of intent and gross negligence, in the event of culpable injury to life, body or health, in the event of fraudulent concealment of a defect, to the extent of a guarantee assumed and in accordance with the provisions of the German Product Liability Act (Produkthaftungsgesetz).

(2) In the event of simple negligence, the Provider is only liable for breach of essential contractual obligations (cardinal obligations), the fulfilment of which makes the proper performance of the contract possible in the first place and on compliance with which the Customer may regularly rely. In this case, liability is limited in amount to the damage typical for the contract and foreseeable at the time the contract was concluded.

(3) Liability under paragraph 2 is limited per claim to the amount of the net remuneration paid by the Customer in the twelve months prior to the event giving rise to the damage, but to at least EUR 5,000; in total, it is limited to EUR 12,000 per contract year. In the cases of paragraph 2, liability for lost profit, savings not made, indirect damage and consequential damage is excluded, insofar as these are not typical for the contract and foreseeable. In the cases of paragraph 2, the Customer’s claims for damages become time-barred twelve months after knowledge; paragraph 1 and claims under Art. 82 GDPR remain unaffected.

(4) Strict liability for defects existing at the time the contract is concluded under § 536a(1) alternative 1 BGB is excluded. Subject to paragraph 1, the Provider is only liable for loss of data in the amount of the effort that would have been required for restoration if the Customer had backed up its data properly and regularly.

(1) The parties undertake to keep secret all confidential information of the respective other party that becomes known to them in connection with this contract (in particular trade and business secrets, Customer Data, non-public product information) and to use it exclusively for the performance of this contract.

(2) The obligation does not apply to information that is or becomes publicly known without this being based on a breach of duty, that was lawfully obtained from third parties, that was demonstrably developed independently or whose disclosure is ordered by law or by the authorities. The obligation continues for the term of the contract and for three years beyond its end; for personal data, it applies without time limit (Art. 28(3)(b) GDPR, § 4 of the DPA). The protection of trade secrets under the German Trade Secrets Act (Gesetz zum Schutz von Geschäftsgeheimnissen – GeschGehG) remains unaffected.

§ 7 applies to the processing of personal data. In addition, the privacy policy and the data processing agreement (DPA) apply.

The Provider is entitled to change these Terms with effect for the future, provided that the changes are reasonable for the Customer, taking its interests into account, and are objectively justified (e.g. adaptation to a changed legal situation or functional enhancements). Changes are communicated to the Customer in text form at least six weeks before they take effect. If the Customer does not object within this period, the amended Terms are deemed accepted; the communication will specifically point out this legal consequence. If the Customer objects in due time, the previous terms continue to apply; in this case, the Provider can terminate the contract ordinarily in accordance with § 9(1). In addition, the Customer has the right to terminate the contract as of the time the change takes effect. Changes that significantly affect the core scope of services or the price structure require the Customer’s consent.

(1) German law applies, excluding the UN Convention on Contracts for the International Sale of Goods (UN-Kaufrecht).

(2) If the Customer is a merchant, a legal entity under public law or a special fund under public law, the exclusive place of jurisdiction for all disputes arising from or in connection with this contract is the Provider’s registered office; the Provider is also entitled to sue the Customer at its general place of jurisdiction.

(3) Transfer of contract: The Provider is entitled to transfer its rights and obligations under this contract in whole or in part to a company affiliated with it within the meaning of §§ 15 et seq. of the German Stock Corporation Act (Aktiengesetz – AktG) or to a legal successor by way of a transfer of business, a transformation or the sale of the business unit concerned. The Provider notifies the Customer of such a transfer in text form at least 30 days before it takes effect. In this case, the Customer is entitled to terminate the contract extraordinarily as of the time of the transfer. The data processing agreement (DPA) continues to apply to the legal successor with unchanged content.

(4) The Customer can only transfer rights and obligations under this contract to third parties with the prior consent of the Provider in text form. § 354a of the German Commercial Code (Handelsgesetzbuch – HGB) remains unaffected.

(5) Changes and amendments to this contract require text form; this also applies to the waiver of this text form requirement. § 14 and individual contractual agreements (§ 305b BGB) remain unaffected.

(6) Should individual provisions of these Terms be or become invalid or unenforceable, the validity of the remaining provisions remains unaffected. In place of the invalid or unenforceable provision, the valid and enforceable provision that comes closest to the economic purpose of the replaced provision is deemed agreed; the same applies to any gaps in the provisions.

(7) Order of precedence: If the contractual documents contradict each other, the data processing agreement (DPA) takes precedence in data protection matters, followed by these Terms and finally the product description pursuant to § 2(2). Individual contractual agreements (§ 305b BGB) take precedence over all contractual documents.

(8) Language of the contract: The language of the contract and of negotiations is German. If these Terms or parts of them are provided in another language, this serves solely for understanding; only the German version is authoritative.