← Back to the start page

General Terms and Conditions

Version 1.2 · 9/24/2026 · SHA-256 2aed4a5a4ec3485be39ccfdfa1128423ee8bf379ad00c41f869b652454ab697a

This translation was produced by machine and is provided for information only. We cannot guarantee that it is free of errors. Only the German version is legally binding. German (binding)

§ 1 Scope, contracting party

  1. These terms apply to the use of the TEPHIA SECURE service (hereinafter the “Service”) of bitnacs GmbH, Humboldtstr. 18, 65189 Wiesbaden, registered in the commercial register of the Local Court (Amtsgericht) of Wiesbaden under HRB 30526 (hereinafter the “Provider”).
  2. The Service is intended exclusively for entrepreneurs within the meaning of § 14 BGB, legal entities under public law and special funds under public law (hereinafter the “Customer”). By registering, the Customer confirms that it is acting in the exercise of its commercial or independent professional activity.
  3. Deviating terms of the Customer do not apply, even if the Provider does not expressly object to them.
  4. The processing of personal data on behalf of the Customer is governed by the Data Processing Agreement (DPA), including its provisions on the protection of professional secrets. In the event of conflicts, the DPA takes precedence over these terms insofar as data protection is concerned.

§ 2 Services

  1. The Provider makes available a service for the encrypted transfer of files: sending to external recipients via a link and a separately transmitted password, upload boxes for receiving files from third parties, as well as the logging of operations and the issuing of proofs thereof.
  2. Files are encrypted in the sender’s browser. The Provider stores neither keys nor passwords and cannot gain knowledge of the stored contents. It therefore cannot recover lost passwords. The browser transmits the password of an upload box once so that the Provider sends it to the user who creates the upload box, at that user’s own address; the password is not stored in the process.
  3. The Service is not an archive. Transferred files are deleted after collection or when the set period expires. The retention of documents, including for the fulfilment of statutory obligations, is the responsibility of the Customer.
  4. The scope of use is determined by the selected plan (number of users, operations per day, storage, size per transfer) as described at the conclusion of the contract. Once a quota is exhausted, the Service does not accept any further operations until the end of the period; existing operations remain retrievable.
  5. Proofs reflect the logged events and are secured against subsequent alteration by a signature, a timestamp and a daily sealed verification chain. The evidential value attributed to them in proceedings is determined by the court or authority concerned; the Provider does not owe any particular assessment.
  6. The Provider develops the Service further. It may change functions insofar as this does not materially restrict the agreed scope of services and the change is reasonable for the Customer.

§ 3 Registration, trial period, conclusion of the contract

  1. Registration requires an address on a domain of the Customer. The Customer proves by means of a DNS record that it owns the domain. Addresses of general e-mail providers are excluded.
  2. A free trial period of 14 days begins upon confirmation of the domain. It ends automatically; no means of payment is required for it. After it ends, the Customer’s data remains accessible for reading and exporting, while sending is blocked.
  3. The paid contract is concluded when the Customer selects a plan and sets up payment. If the Customer makes its selection before the trial period expires, billing begins only when the trial period ends.
  4. The Customer ensures that its details are accurate and keeps them up to date.

§ 4 Obligations of the Customer

  1. The Customer keeps access credentials, second factors and passwords for transfers secret and obliges its users accordingly. It assigns roles and access rights only to the extent necessary and revokes them when they are no longer needed.
  2. The Customer uses the Service only within the framework of the applicable laws. In particular, the transfer of malware or of content whose distribution is a criminal offence is prohibited, as is use of the Service to circumvent the security measures of third parties or for unsolicited mass mailings.
  3. The Customer is itself responsible for the content that it and its users transfer and for the selection of recipients.
  4. The Customer notifies the Provider without undue delay if it has indications of misuse of its access.

§ 5 Blocking in the event of misuse

  1. If there are concrete indications of a breach of § 4(2), the Provider may temporarily block individual operations or the Customer’s access insofar as this is necessary to avert damage. In doing so, it takes into account the legitimate interests of the Customer and chooses the least intrusive suitable means.
  2. The Provider informs the Customer of the blocking and the reason for it, unless a statutory obligation or an official order precludes this, and lifts the blocking as soon as the reason for it no longer applies.

§ 6 Remuneration, payment

  1. The prices of the selected plan at the time the contract is concluded apply. All prices are exclusive of statutory value added tax.
  2. The remuneration is payable in advance for the respective billing period (month or year). Payment is made by direct debit or card via the payment service provider Stripe. The Customer receives invoices electronically.
  3. If the Customer is in default with a payment, the Provider may, after prior notification, block sending until the outstanding invoice has been paid; the data remains accessible for reading and exporting. Further rights remain unaffected.
  4. Individually agreed conditions apply for the agreed period. Thereafter, the regular prices of the plan apply unless otherwise agreed.
  5. The Provider may change the prices with effect from the beginning of the next billing period by giving at least six weeks’ notice in text form (e.g. e-mail). In this case, the Customer may terminate the contract with effect from the time of the change; the Provider points this out in the notice.

§ 7 Term, change of plan, termination

  1. With monthly payment, the contract runs for one month at a time; with annual payment, for one year at a time. It is extended by the same period unless it is terminated by the end of the current period.
  2. Termination is possible at any time with effect from the end of the current period, in the Service’s administration area or in text form (e.g. e-mail). Amounts already paid for the current period are not refunded unless otherwise agreed.
  3. A change to a larger plan or from monthly to annual payment takes effect immediately; the difference is charged pro rata. A change to a smaller plan or to monthly payment takes effect at the end of the current period. It is not possible to change to a plan whose user limit is below the number of active users.
  4. The right to extraordinary termination for good cause remains unaffected.

§ 8 End of the contract, deletion

  1. After the end of the contract, the Customer can read and export its proofs during a period of 30 days. Thereafter, its data is deleted unless a statutory retention obligation precludes this. Details are governed by the DPA.

§ 9 Availability, maintenance

  1. The Provider operates the Service with the care customary in business dealings and aims for high availability. A specific level of availability is owed only if it has been separately agreed.
  2. The Provider carries out maintenance work, where possible, at times of low usage and announces longer interruptions in advance. Interruptions caused by circumstances for which the Provider is not responsible, in particular disruptions of the internet, force majeure or failures of service providers carefully selected by the Provider, are not attributable to it.

§ 10 Liability

  1. The Provider is liable without limitation in cases of intent and gross negligence, for injury to life, body or health, under the Product Liability Act (Produkthaftungsgesetz) and to the extent of any guarantee it has assumed.
  2. In cases of slight negligence, the Provider is liable only for breach of an essential contractual obligation, the fulfilment of which makes the proper performance of the contract possible in the first place and on compliance with which the Customer may regularly rely. In that case, liability is limited to the damage that was foreseeable at the time the contract was concluded and is typical for this type of contract, but not exceeding the remuneration for the twelve months preceding the event giving rise to the damage.
  3. The Provider is liable for the loss of data only to the extent of the loss that would have occurred had the Customer properly retained the documents (§ 2(3)).
  4. Liability under the DPA and under Art. 82 GDPR remains unaffected.

§ 11 Amendments to these terms

  1. The Provider may amend these terms with effect for the future insofar as this is necessary for a valid reason, for example due to a change in the legal situation or case law or to adapt them to new functions, and the amendment does not unreasonably disadvantage the Customer.
  2. The Provider announces amendments at least six weeks before they take effect, in text form (e.g. e-mail) and in the Service’s administration area. The Customer accepts the new version in the administration area. If the Customer has not accepted it by the time it takes effect, sending may be blocked until acceptance; in this case, the Customer may terminate the contract with effect from the time the amendment takes effect.

§ 12 Final provisions

  1. The law of the Federal Republic of Germany applies, to the exclusion of the UN Convention on Contracts for the International Sale of Goods (CISG).
  2. The exclusive place of jurisdiction for all disputes arising from this contract is Wiesbaden, provided that the Customer is a merchant, a legal entity under public law or a special fund under public law.
  3. Amendments and supplements must be made in text form (e.g. e-mail).
  4. Should any provision be invalid, the validity of the remaining provisions shall remain unaffected.

TEPHIA SECURE · Guide · Security · Legal notice · Privacy · Terms