Terms and conditions
These terms apply to the services of CAYADA GmbH. § 1 and § 2 set out the scope and the nature of the services — including which activities are expressly not part of the offering.
This is a courtesy translation. The German version is authoritative and legally binding.
As of September 2026
§ 1 Scope
These terms and conditions apply to contracts between CAYADA GmbH (“CAYADA”) and its clients regarding services in the areas of appointed functions, training, compliance organisation, information technology and use of the CAYADA compliance portal.
The services of CAYADA GmbH are directed exclusively at entrepreneurs within the meaning of § 14 of the German Civil Code, at legal persons under public law and at special funds under public law.
CAYADA GmbH is a compliance and technology company and not a law firm. Where CAYADA is appointed as external data protection officer, the service also covers the statutory information and advisory duties within the scope of Art. 39 GDPR. Legal advice outside that scope, legal representation and other services reserved to lawyers are not provided by CAYADA. Where a matter requires handling by a lawyer, a separate mandate with an independently acting lawyer or law firm is needed; the client remains free in that choice.
§ 2 Nature and scope of services
The nature, scope and approach of the services are agreed in writing before commencement and follow from the respective proposal or service description.
Where CAYADA is appointed as external data protection officer, the scope of services follows the statutory scope of duties under Art. 39 GDPR. Separate service descriptions apply to the function of EU representative under Art. 27 GDPR and to operating an internal reporting office as a commissioned third party.
The function of EU representative is not combined with a DPO mandate for the same controller. The technical build of systems is not combined with a DPO mandate for the same controller.
Training conveys general and role-related content. A binding legal review of the individual case, binding classifications of applicability or risk, and individual contract drafting are not part of the CAYADA services.
§ 3 Formation of contract
The contract is formed when the client accepts CAYADA's proposal. Acceptance may be given in writing or electronically.
§ 4 Client cooperation
The client provides the information, documents and contacts required for delivery in good time. Decisions on the purposes and means of processing, legal bases, balancing of interests and approvals are taken by the client. Delays caused by a lack of cooperation are not attributable to CAYADA.
§ 5 Fees and payment
Fees follow from the respective proposal. All prices are exclusive of statutory VAT. Invoices are payable within 14 days without deduction unless agreed otherwise.
§ 6 Term and termination
Ongoing contracts – for example assuming the data protection officer function – renew automatically for the agreed term unless terminated with three months' notice to the end of the term. The right to terminate for cause remains unaffected.
§ 7 Confidentiality and data protection
Both parties treat all information obtained in the course of the cooperation as confidential. Where personal data is processed on our behalf, the parties conclude an agreement pursuant to Art. 28 GDPR. Our privacy notice applies in addition.
§ 8 Rights of use in work results
The client receives a simple, unlimited right to use the documents and concepts prepared for it for its own operational purposes. That right of use also covers reproduction, adaptation, publication and internal or external transfer, insofar as this serves the client's own operational purpose. Any commercial exploitation detached from that purpose requires CAYADA's consent.
§ 9 Liability
CAYADA is liable without limitation for intent and gross negligence, for injury to life, body or health, for fraudulent concealment of a defect, to the extent of any guarantee given, and under the German Product Liability Act.
In cases of simple negligence, CAYADA is liable only for the breach of material contractual obligations. Obligations are material if their fulfilment is what makes the proper performance of the contract possible in the first place and on whose observance the client may regularly rely. In such cases liability is limited to the damage foreseeable at the time of contract conclusion and typical for this type of contract.
Otherwise liability for simple negligence is excluded.
Where the contract places the securing of certain data with the client and this is technically possible for the client, CAYADA is liable in cases of simple negligence only for the restoration effort that would also have arisen had data been backed up properly and regularly. CAYADA's own contractual obligations to secure data, in particular when operating the CAYADA compliance portal, remain unaffected.
The above provisions do not entail any change in the burden of proof to the client's detriment.
§ 10 Final provisions
The law of the Federal Republic of Germany applies. Place of jurisdiction is, to the extent legally permissible, the registered office of CAYADA GmbH. Should individual provisions be invalid, the validity of the remaining provisions remains unaffected.