Legal, Privacy & Terms & Conditions

These terms apply to everything NIS2Have provides: the document kits, the web application at nis2have.eu/app, and free offerings such as the applicability check.

They are the general framework. Whatever applies in addition to or differently from them in an individual case — in particular the data processing agreement, the technical and organisational measures, and your order — is available once you are signed in, under Vertrag & Sicherheit in your organisation. Those documents take precedence over these terms (§ 1(4)).

(1) These terms govern all contracts between David Steng, Silberpappelstraße 11, 71364 Winnenden, Germany (“NIS2Have”) and the customer concerning (a) the supply of document kits in Word, Excel and PDF format (“kits”), (b) the provision of the web application for use over the internet (“the application”), and (c) free services such as the applicability check and free guides.

(2) Business customers only. Contracts are concluded exclusively with entrepreneurs within the meaning of § 14 BGB, legal persons under public law and special funds under public law. The customer warrants that, in concluding the contract, it acts in the exercise of its commercial or independent professional activity. No contract is concluded with consumers.

(3) Deviating or supplementary terms of the customer do not become part of the contract, even if NIS2Have does not expressly object to them.

(4) Contract documents and order of precedence. The following apply in this order: (i) the individual order or quotation, (ii) the documents provided under Vertrag & Sicherheit in the application, in particular the data processing agreement and the technical and organisational measures, (iii) these terms.

(5) The version in force at the time the contract is concluded applies. The current version is available at this address and can be saved and printed.

(6) Language versions. These terms are provided in German, English and French. The German version prevails; the others are non-binding translations. Where a translation is followed by a German legal term in parentheses, the German legal term shall prevail.

(1) The presentation of services on the website is not a binding offer. By ordering, the customer makes an offer; the contract is concluded when NIS2Have confirms it or provides the service.

(2) All prices are net. In accordance with § 19 UStG (German small business regulation), no VAT is shown.

(3) Payment is processed by Stripe. Subscriptions are payable in advance for the respective billing period. Kits are made available for download or by email without delay after receipt of payment, at the latest within 24 hours.

(4) Price adjustment for subscriptions. NIS2Have may adjust fees at most once per contract year, giving six weeks' notice with effect from the start of the next billing period. The customer may then terminate for cause with effect from that date; the notice will say so.

(5) No right of withdrawal. There is no right of withdrawal, as contracts are concluded exclusively with entrepreneurs.

(1) Kits. NIS2Have supplies personalised templates and guides for download. The customer receives an unlimited right to use the version delivered, in accordance with § 4; updates are governed by § 8.

(2) The application. NIS2Have provides the application for use over the internet for the term of the contract, to the extent of the modules and seats booked. The contract for the application is a lease within the meaning of §§ 535 et seq. BGB. The point of delivery is where data passes from the data centre into the internet; NIS2Have is not responsible for the connection from there to the customer.

(3) Free services may be changed or discontinued at any time. No availability is warranted for them.

(4) The following is expressly not part of the contract:

• • Legal advice. NIS2Have does not provide a legal service within the meaning of § 2 RDG. No legal examination of the individual case takes place.
• • Tax advice, statutory audit, or individual information-security consulting.
• • Certification, auditing, or confirmation of a compliance status.
• • Active security testing. The applicability check evaluates publicly available information only (OSINT). No active vulnerability scanning and no penetration testing of the customer's systems or those of third parties takes place, nor is any owed.
• • Review, assessment or approval of the content entered by the customer and of the documentation the customer produces.
• • Any assurance that use will result in compliance with BSIG/NIS2UmsuCG, the GDPR or other requirements, or in recognition by an authority.

Content, templates, checklists and assessments are general information and working aids. Legal assessment, adaptation to the individual case and implementation are the customer's responsibility; where necessary, the customer must have them examined by a qualified third party.

(5) Automated assessments and AI. Parts of the service — in particular the applicability check and individual assessments — are generated automatically using third-party AI systems. They may be incomplete or incorrect and must be verified by the customer before any use. No automated decision producing legal effects within the meaning of Art. 22 GDPR takes place. Their use is disclosed pursuant to Art. 50 of Regulation (EU) 2024/1689.

(6) No contract for work, no result owed. The subject matter of the contract is the supply of templates and the provision of the application, not the production of a work (Werk). No particular result is owed — in particular not complete, audit-proof or officially recognised documentation — and no acceptance (Abnahme, § 640 BGB) takes place.

(7) Preview and test features — those marked “beta”, “pilot” or “in preparation” — are provided without warranty and without any availability commitment, and may be changed or discontinued at any time.

(1) Kits. The customer receives a simple, non-exclusive, non-transferable and non-sublicensable right to use the templates for internal purposes within the named company, unlimited in time. Permitted in particular: editing and completing them, submitting them to the BSI or other authorities, making internal copies for employees, and adapting them to the customer's own circumstances.

(2) The application. The customer receives a simple, non-transferable right of use, limited to the term of the contract and the seats booked. A seat is assigned to one natural person and must not be shared; it may be reassigned to another person when the first leaves.

(3) Prohibited: distribution, sale, rental or transfer to third parties; publication on the internet or in third-party intranets; use by other companies including affiliated companies and group subsidiaries (each requires its own licence); removing or altering licence IDs, watermarks or copyright notices; use as the basis for the customer's own commercial template or software products; reverse engineering beyond § 69e UrhG; automated bulk retrieval; and security testing without prior written consent.

(4) Personalisation. Kits carry a unique licence ID and the customer's company name in the document properties, headers and footers, and metadata. In the event of a breach of paragraph 3, NIS2Have reserves the right to revoke the licence and claim damages; unauthorised distribution is traceable via the licence ID.

(1) NIS2Have targets availability of the application of 95% on a monthly average, measured at the point of delivery under § 3(2).

(2) The following do not count as downtime: announced maintenance windows (as a rule outside 08:00–18:00 on business days, announced at least 24 hours in advance), urgent security measures, force majeure under § 12, disruptions within the customer's sphere or that of its access provider, and disruptions at third parties whose services are required for operation, provided NIS2Have selected and monitored them properly.

(3) Current operating status and past incidents are published without login at nis2have.eu/status.

(4) Support is provided on business days by email and through the contact form. No response or restoration time is warranted unless individually agreed.

(5) The customer does not execute a rent reduction under § 536 BGB unilaterally, but asserts it by giving notice to NIS2Have. § 14(3) remains unaffected.

(1) The customer keeps access credentials confidential, does not pass them on, and reports any suspected misuse without delay. The customer is responsible for actions taken through the seats assigned to it.

(2) The customer submits only lawful content, infringes no third-party rights, and introduces no malicious software.

(3) Personal data of third parties — for example emergency contacts, training participants or supplier contacts — may be entered only where the customer is entitled to do so. In that respect the customer is the controller within the meaning of Art. 4(7) GDPR.

(4) Backups. The customer exports the data it has entered at reasonable intervals and before the contract ends, and keeps it outside the application. Where the application provides no export function for a given set of data, NIS2Have supplies it on request in a common, machine-readable format.

(5) The customer ensures the system requirements: a current browser and suitable internet access.

(6) The customer reports defects without delay and in a comprehensible manner. § 377 HGB remains unaffected.

(7) Indemnity. If the customer breaches paragraphs 2 or 3, it shall, at its own cost, defend, indemnify and hold NIS2Have harmless from and against all third-party claims arising from that breach, including reasonable costs of legal defence.

(1) The data the customer enters remains the customer's data. NIS2Have processes it solely to perform the contract.

(2) Where NIS2Have processes personal data on the customer's behalf, the data processing agreement applies. It is available, together with the technical and organisational measures and the list of sub-processors, under Vertrag & Sicherheit in the application. Details of the processing are set out in the privacy notice.

(3) No AI model training. NIS2Have does not use customer data to train its own or third-party AI models. Any evaluation for statistical purposes is carried out only in anonymised or aggregated form.

(4) After the contract ends, the customer's data remains available for 30 days; NIS2Have supplies it on request in a common, machine-readable format. It is then deleted within a further 30 days, unless statutory retention obligations apply; § 147 AO and § 257 HGB apply to invoicing and licence data.

(5) Confidentiality. Each party keeps confidential any information of the other that is marked confidential or recognisably so, uses it only to perform the contract, and discloses it only to those who need it for that purpose and are themselves bound accordingly. This does not apply to information that was already known to the receiving party, that it lawfully obtained afterwards from a third party under no duty of confidence, that is or becomes public without breach of this clause, or that it developed independently without recourse to the confidential information. Statutory or official disclosure obligations remain unaffected; the affected party informs the other where that is permitted. The obligation applies for the term of the contract and for three years afterwards, and for trade secrets within the meaning of the GeschGehG for as long as they remain trade secrets.

(1) Kits. The customer receives free updates for 12 months from the date of purchase where the requirements under BSIG/NIS2UmsuCG or BSI guidance change. Updates are delivered by email. After that period there is no claim to further free updates; a paid extension may be offered separately.

(2) The application. The application is developed continuously. NIS2Have may change, extend or replace features provided the contractual benefit is not materially impaired. NIS2Have will announce material reductions in functionality at least six weeks in advance in text form; the customer may then terminate for cause with effect from that date.

(1) The purchase of a kit does not create a continuing obligation; the right of use under § 4(1) is unlimited in time.

(2) The term for the application follows the order. It renews for the same period unless terminated with 14 days' notice (monthly term) or one month's notice (annual term) to the end of the term.

(3) The right to terminate for cause remains unaffected. For NIS2Have, good cause exists in particular where there is a material breach of § 4 or § 6, or payment default exceeding two monthly amounts.

(4) Termination and payment collection are two different things. Notice must be given in text form; an email is sufficient and effective. On its own, however, it does not stop collection by our payment provider. The customer therefore also cancels the running subscription in the subscription management linked under Vertrag & Sicherheit. Where the customer has only given notice in text form, we arrange for the subscription to end without undue delay; any amount collected regardless is refunded.

(5) Suspension. In the event of a material breach, NIS2Have may temporarily suspend access after prior notice. The claim to remuneration remains for that period. Read access to data already entered, and its export, remain possible where reasonable and where the ground for suspension does not preclude it.

(1) Kits. The statutory warranty for digital products in business-to- business dealings applies. Subsequent performance is rendered by supplying a corrected version.

(2) The application. §§ 535 et seq. BGB apply. Strict liability irrespective of fault for defects already present at the conclusion of the contract (§ 536a(1) alt. 1 BGB) is excluded.

(3) Immaterial deviations, and impairments caused by use contrary to the contract, by changes made by the customer, or by disruptions within the customer's sphere, are not defects.

(4) No acceptance takes place (§ 3(6)). Using the application, downloading templates and paying fees are not an acceptance and not an acknowledgement that performance conformed to the contract.

(1) NIS2Have is liable without limitation (a) for intent and gross negligence, (b) for damage arising from injury to life, body or health, (c) under the German Product Liability Act, and (d) to the extent of a guarantee given and in the event of fraudulent concealment of a defect.

(2) In cases of slight negligence, NIS2Have is liable only for breach of a material contractual obligation, and then limited in amount to the damage foreseeable and typical for this type of contract at the time it was concluded. Material obligations are those whose fulfilment makes proper performance of the contract possible in the first place and on whose observance the customer may regularly rely.

(3) Amount. The foreseeable, contract-typical damage under paragraph 2 is limited to the fees the customer paid for the affected service in the twelve months before the event causing the damage (the contract volume). No minimum amount is agreed. For services provided free of charge those fees are nil, and there is accordingly no liability under paragraph 2.

(4) Loss of data. Liability for loss of data is limited to the effort that would have been required to restore it had the customer backed up its data in accordance with § 6(4).

(5) Indirect damage, consequential loss, lost profit. Within the scope of paragraph 2, NIS2Have is not liable for lost profits, savings not realised, or indirect damage, unless such damage was at the same time typical for this type of contract and foreseeable at the time of conclusion. Where there is such liability, the limit in paragraph 3 applies; no amount beyond it is owed.

(6) There is no liability for the accuracy, completeness or legal conformity of the documentation produced by the customer, nor for fines, sanctions or other measures taken by authorities against the customer. The reason is § 3(4): legal assessment and implementation are the customer's responsibility.

(7) Paragraphs 2 to 6 do not apply in the cases covered by paragraph 1.

(8) The above limitations also apply in favour of NIS2Have's legal representatives, employees and vicarious agents.

(9) § 254 BGB (contributory negligence) remains unaffected, in particular where the customer has breached § 6(4) (backups) or the duty of examination under § 3(4).

(10) Limitation period. Claims of the customer against NIS2Have become time-barred one year after the statutory commencement of the limitation period. This does not apply to claims under paragraph 1, nor in the event of fraudulent concealment of a defect; the statutory periods continue to apply in those cases (§ 202(1) BGB).

Events beyond a party's control — in particular natural events, war, industrial action, measures by authorities, large-scale failures of power, telecommunications or cloud infrastructure, and attacks on information technology — release that party from its obligation to perform for their duration and to the extent of their effect. The affected party gives notice without delay. If the event lasts longer than six weeks, either party may terminate the affected contract.

(1) Each contract is governed by the version of these terms the customer accepted when the contract was concluded. Later versions do not apply to that contract.

(2) The accepted version is kept available permanently, with its version label and date, under Vertrag & Sicherheit in the application, and can be retrieved there at any time. The time of acceptance and the person accepting are recorded with it.

(3) NIS2Have may publish a new version for future contracts at any time. New customers then contract on that version; nothing about an existing contract changes.

(4) The version governing an existing contract can only be changed with the customer's consent. NIS2Have may seek that consent under Vertrag & Sicherheit; if the customer does not give it, the existing version continues to apply.

(5) On a renewal under § 9(2) the version previously accepted continues to apply.

(1) German law applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

(2) The exclusive place of jurisdiction for all disputes is Winnenden, Germany, where the customer is a merchant, a legal person under public law or a special fund under public law. NIS2Have is also entitled to sue at the customer's general place of jurisdiction.

(3) The customer may set off only against undisputed claims or claims established by a final court decision. The customer has a right of retention only in respect of claims under the same contractual relationship.

(4) The customer may transfer rights and obligations under the contract only with NIS2Have's consent. § 354a HGB remains unaffected.

(5) There are no oral ancillary agreements. Amendments and additions require text form; this also applies to any waiver of this form requirement. Individually agreed terms take precedence (§ 305b BGB).

(6) Should individual provisions be or become wholly or partly invalid or unenforceable, or should the contract contain a gap, the validity of the remaining provisions is unaffected. In place of the invalid, unenforceable or missing provision, such valid and enforceable provision shall be deemed agreed as the parties would have agreed, having regard to the commercial purpose of the contract, had they been aware of the invalidity, unenforceability or gap when the contract was concluded.

(7) NIS2Have does not participate in dispute resolution proceedings before a consumer arbitration board; the services are addressed exclusively to businesses.

Version of 22 August 2026. The version in force when your contract was concluded is the one that applies to it; the current version is always available at this address. Signed-in customers can see the version that applies to them, and when they accepted it, under Vertrag & Sicherheit in their organisation.