General Terms and Conditions (T&C)

Last updated: 1 October 2026. These General Terms and Conditions apply to contracts concluded by OTOKO® GmbH, Salierring 42, 50677 Cologne, Germany, with businesses within the meaning of section 14 of the German Civil Code (BGB), legal entities under public law and special funds under public law, where their application has been agreed. They are not intended for contracts with consumers.

OTOKO® GmbH is represented by managing director Yahya Zahad and registered with Amtsgericht Köln under HRB 111269. Contact: info@otoko.com, +49 221 29 26 23 7.

Individual agreements take precedence. Publication on the website does not incorporate these terms into a particular contract.

Descriptions of services and products on otoko.com provide information and generally do not constitute binding contractual offers. A contact enquiry, demo request or use of a “Test product” button does not place an order for a paid service. An automated acknowledgement only confirms transmission.

A contract is concluded through acceptance of an offer or another corresponding agreement between the parties. The particular offer, service specification and agreed conditions determine its contents.

Depending on the agreement, we provide consulting, development, integration, migration, operation, maintenance, support and training, or supply hardware, software or rights of use. An offer covers only the services agreed in it.

Project objectives, deliverables, responsibilities, dates, technical prerequisites and, where applicable, acceptance criteria are specified for each engagement. Whether a particular result or professionally performed services are owed depends on the contract. A technology description does not promise suitability for every customer environment without assessment.

To the extent required, the customer provides suitable contacts, information, access and materials it is entitled to use. Access rights and maintenance windows for production systems are coordinated. Confidential information is exchanged through agreed secure channels.

Both parties inform each other about foreseeable obstacles and risks. Effects on timing, effort and scope are clarified transparently. A unilateral notice of additional effort does not, by itself, create an additional payment obligation; the agreement and applicable law govern this issue.

Changes or extensions are coordinated regarding effort, price, timing and technical consequences before implementation. The parties should document their agreement in text form, for example by email or an approved change request. Statutory form requirements remain unaffected.

Penetration tests, software analysis and other active security assessments are performed only within an expressly authorised scope. This includes valid authorisation for target systems, permitted methods, test windows and incident contacts. Third-party systems may be included only with the necessary authorisation.

For success-based offers such as “Result as a Service”, success criteria, testing methods, evidence, exclusions and remuneration must be expressly defined in the individual contract. The marketing label alone does not replace this agreement. A test report describes the assessed environment and agreed testing period; it does not guarantee that a system is free of all present or future vulnerabilities.

For hardware and security products, the agreed model, version, licence and delivery configuration determine the supply. Statements about approvals, such as VS-NfD, EU RESTRICTED or NATO RESTRICTED, relate exclusively to the approved product version and its binding conditions of use.

A product approval does not approve an entire customer infrastructure. Organisational measures, operating conditions, official requirements and suitability for the intended deployment must be considered in the project. Changes to approved configurations require assessment of their effect on the approval.

Scope, allocation of responsibilities, data locations, permissions and, where relevant, subcontractors are specified in the individual engagement. Availability, response times, recovery objectives, backups and on-call coverage apply only to the extent expressly agreed.

A general service description does not automatically include round-the-clock support or unlimited backups. Before production changes, the parties coordinate necessary backup and recovery measures. Statutory obligations and expressly assumed responsibilities remain unaffected.

Prices, billing model, payment terms, travel costs and other expenses are governed by the accepted offer or contractual agreement. The agreement also specifies whether services are charged by time and materials, fixed price, milestones or recurring fees.

Where no valid alternative arrangement exists, statutory rules on payment becoming due and late payment apply. These terms introduce no additional flat-rate fees or price-adjustment rights independent of the offer.

The contract determines the rights to use software, work results and documentation. It may specify user numbers, purpose, duration, modification rights, source-code delivery and use by affiliated companies. In the absence of express provisions, statutory rules, including the purpose of the contract, apply.

Third-party products and open-source components may be subject to separate licence conditions. Where relevant to the agreed use, those conditions must be made available before the customer enters the corresponding contractual commitment. Mandatory statutory rights remain unaffected.

For work requiring acceptance, inspection and acceptance are governed by agreed criteria and statutory rules. Deviations should be described sufficiently clearly to enable investigation and handling. Not every consulting or support service requires acceptance under a contract for work.

Statutory rights concerning defects remain applicable unless a valid alternative has been agreed in the particular contract. These terms do not shorten statutory limitation periods or introduce an additional deemed-acceptance provision. Statutory inspection and notification duties remain unaffected where applicable.

Our liability is governed by statutory law. These terms do not establish blanket exclusions of liability or financial liability caps. Any particular allocation of risk requires a separate, legally valid agreement.

Information recognisably disclosed as confidential may be used only for agreed purposes and by authorised persons. Statutory disclosure obligations remain unaffected. Additional confidentiality, security and deletion obligations may be agreed separately.

Where we process personal data on the customer’s behalf, an agreement under Article 28 GDPR is required before processing begins. Data protection roles depend on the actual activity. Information about website, enquiry and application data is provided in our Privacy Policy.

Contract duration, notice periods and any renewals are set out in the individual contract. These terms do not create an automatic renewal. Statutory termination rights remain unaffected.

Necessary handover, data exports, removal of access and deletion should be coordinated with regard to existing rights and retention obligations. Additional transition services and their remuneration require a separate agreement unless already owed under the contract or applicable law.

Contracts covered by these terms are governed by German law. Mandatory applicable provisions remain unaffected. Without a specific valid agreement on jurisdiction, jurisdiction is determined by statutory rules.

If a provision is invalid, its consequences are governed by statutory law, particularly section 306 BGB. Invalid general terms are replaced by statutory provisions. Updates to this website version do not automatically amend existing contracts.