NIPPON MAYER LTD.

CONNECTIVITYTERMS AND CONDITIONS
1st October 2022

Scope and update of version
The following terms and conditions including their appendices andannexes (“Agreement”) of NIPPON MAYER LTD., 27-33 Kamikitano
1-Chome, 918-8522 Fukui-City, Japan (hereinafter referred to as“KARL MAYER STOLL”) stipulate rights and obligations in connection with textile machines (“Machines”), which (i) KARL MAYER
STOLL has provided to the “Customer” for use and which (ii) bymeans of a gateway (“k.ey device”) can communicate with theCustomer and with companies of the KARL MAYER Group via theInternet. The Customer and KARL MAYER STOLL are hereinafter
individually also referred to as “Party” and jointly also as “Parties”. Ifother contractual agreements with (partly) similar content alreadyexist between KARL MAYER STOLL and the Customer, these
agreements shall be replaced by this Agreement. Earlier versions of
this Agreement existing between the Parties are superseded by thisAgreement.

page 1 / 21

Table of Contents
List of definitions. .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 3Preamble .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 3A.	 General regulations; Solutions; Use of the Platform .  .  .  .  .  .  .  . 31. Solutions; Platform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Confidentiality. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Rights to data; Processing of data; Protection of secrets . . . . . . . 4
4.	Information on Solutions and k.ey devices; Quality
specifications; Product information and labelling. . . . . . . . . . . . . . 4
5. Liability; Limitation of liability; Statute of limitations. . . . . . . . . . . 5
6. Service provision by the KARL MAYER Group; Transfer . . . . . . . . 5
7.	Applicable law; Arbitration clause; Severability clause; Singularand plural formulations; Contract amendments and written
form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
B.	 Provision and maintenance of the k.ey device.  .  .  .  .  .  .  .  .  .  .  .  .  . 68. Subject of the Agreement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
9.	Hardware-related obligations and rights of KARL MAYER STOLL
within the scope of the transfer of the k.ey device . . . . . . . . . . . . . 6
10.	Software-related obligations and rights of KARL MAYER STOLL
within the scope of the transfer of the k.ey device . . . . . . . . . . . . . 6
11.	Obligations of the Customer within the scope of the provisionand maintenance of the k.ey device. . . . . . . . . . . . . . . . . . . . . . . . . . . 6
12.	No warranty extension through surrender of the k.ey device;
Liability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
C.	 Connectivity Packages .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 613. Object of the Connectivity Packages. . . . . . . . . . . . . . . . . . . . . . . . . . 6
14. Customer’s obligations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
15. Obligations of KARL MAYER STOLL. . . . . . . . . . . . . . . . . . . . . . . . . . 7
16. Default in payment; Setoff; Right of retention. . . . . . . . . . . . . . . . . 7
17.	Delivery time; Force majeure; Reservation of self-delivery; Earlyor partial deliveries; Amendments. . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
18.	Notice of defects; Claims for defects; No right of withdrawal;
Use of the Remote Service Connection . . . . . . . . . . . . . . . . . . . . . . . 7
List of Appendices and Annexes . .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 8Content and scope of the Connectivity Packages .  .  .  .  .  .  .  .  .  .  .  .  .  . 819. SaaS Solution Dashboard Lite. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
20. Remote Service Connection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
21. Remote Set-Up and Installation Support for Connectivity . . . . . . 9
Annex A: Product data sheet; k.management; Dashboard Lite. . . . . . 9
1. Dashboard Lite – Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2. Specification and description of the Dashboard Lite. . . . . . . . . . . . 9
Annex B: Hardware requirements, network requirements, andnecessary system environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1. k.ey device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2. Customer terminal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.	Hardware requirements and network requirements related
to the Machine and Connectivity Packages, as well as thenecessary system environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Annex C: Service Level Agreement – Dashboard Lite and Remote
Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.	Scope of this Service Level Agreement – Dashboard Lite;
Relationship to the Agreement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2. Definitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3. Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4. Remote Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
5. Incident Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
6. Maintenance Work. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Appendix 2: Data Processing Agreement for the Connectivity
Terms and Conditions (Art. 28 GDPR). .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 13
1. Definitions, starting point and ranking . . . . . . . . . . . . . . . . . . . . . . . 13
2. Object, duration, and specification of the Data Processing. . . . . 13
3. Technical and organisational measures. . . . . . . . . . . . . . . . . . . . . . 13
4. Rights of data subjects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
5.	Quality assurance and other obligations of
KARL MAYER STOLL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
6. Sub-processing relationships. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
7. Control rights of the Customer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
8. Reports of infringements on the part of KARL MAYER STOLL. 15
9. Authority of the Customer to issue instructions . . . . . . . . . . . . . . 15
10.	Erasure of Personal Customer Data and return of datacarriers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Appendix 2 Annex 1: Technical and organisational measures. . 15
A.	General.  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 15
1. Confidentiality (Art. 32(1)(b) GDPR). . . . . . . . . . . . . . . . . . . . . . . . . . 15
2. Integrity (Art. 32(1)(b) GDPR). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3. Availability and resilience (Art. 32(1)(b) GDPR) . . . . . . . . . . . . . . . 16
4.	Procedures for periodic test, assessment and evaluation (Art.
32(1)(d), Art. 25(1) GDPR). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
B.	Cloud services / data centres in which the Solutions andthe Platform are hosted (currently AWS Cloud service).  .  .  . 16
1. Information Security Programme. . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2. Ongoing assessment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Appendix 2 Annex 2: Authorised sub-processors.  .  .  .  .  .  .  .  .  .  .  .  . 18
Appendix 3: Terms and conditions in relation to the Act on theProtection of Personal Information and other data laws andregulations related to data protection in Japan.  .  .  .  .  .  .  .  .  .  .  .  .  .  . 18
1. Definitions, starting point and ranking . . . . . . . . . . . . . . . . . . . . . . . 18
2.	Object, duration, and specification of the Japanese Data
Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3. Technical, organisational and other measures. . . . . . . . . . . . . . . . 19
4. Rights of data subjects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
5.	Quality assurance and other obligations of
KARL MAYER STOLL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
6. Sub-processing relationships. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
7. Control rights of the Customer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
8.	Reports of infringements on the part of KARL MAYER STOLL. 20
9. Authority of the Customer to issue instructions . . . . . . . . . . . . . . 21
10.	Erasure of Japanese Personal Customer Information andreturn of data carriers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
11. Other Provisions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

page 2 / 21

List of definitions
For the purposes of this Agreement, the following definitions shall
apply

(A)

“Accounting Year”

As defined in Appendix 1.

“Agreement”

As defined in Scope and version described above.

“Commissioned Data
Processing”

As defined in Appendix 2.

“Connectivity Packages”

As defined in the preamble (B).

“Customer”

As defined in Scope and version described above.

“Dashboard”

As defined in Appendix 1 Annex A.

“Dashboard Lite”

As defined in Appendix 1 Annex A.

“Data Processing”

As defined in Appendix 2.

“EU”

As defined in Appendix 2.

“EEA”

As defined in Appendix 2.

“Defective Provision”

As defined in Section 7.4.

“Confidential Information”

As defined in Section 2.1.

“Cardinal Duty”

As defined in Section 5.2.

“GDPR”As defined in Section 3.6.

“KARL MAYER Group”

All companies which are Associated Companies (kankei
gaisha) of KARL MAYER STOLL as defined in theRegulation on Corporate Accounting [Japanese Kaisha
Keisan Kisoku, Ministry of Justice Order No. 13 of 2006]
and, in addition, any other person, company, joint
venture or other legal entity that is directly or indirectly
controlled, through one or more intermediaries, by
KARL MAYER Holding GmbH & Co. KG, Industriestr. 1,
63179 Obertshausen, Germany. For the purposes of thisdefinition, “control” means the power to direct the
management and policies of an enterprise, or cause
them to be directed, whether by virtue of ownership of
the shares or voting rights, by contract or otherwise.

(B)

(C)

(D)

“k.ey device”

As defined in Scope and version described above.

“Delivery Data”

As defined in Section 3.1.

“Japanese Data Processing”

As defined in Appendix 3.

“Japanese Personal
Customer Information”

As defined in Section 3.6 and Appendix 3.

“Machine”

As defined in Scope and version described above.

“myKM.ON”

As defined in the preamble (B).

“Outsourced Data
Processing”

As defined in Appendix 3.

“Parties”

As defined in Scope and version described above”Party”

As defined in Scope and version described above.

“Personal Customer Data”

As defined in Section 3.6 and Appendix 2.

“Platform”

As defined in the preamble (B).

“Solutions”

As defined in the preamble (B).

“SLA”

Service Level Agreement – Dashboard Lite and Remote
Services.

“Statistics Function”

As defined in Appendix 1 Annex A Section 2.5.

“Overview Page”

As defined in Appendix 1 Annex A.

“Transfer”

As defined in Section 6.2.

“Networkable Machine”

As defined in Appendix 1 Annex B Section 3.1.

“Networked Machine”

As defined in Appendix 1 Annex A.

PreambleOn the hardware side, the Customer may already use one ormore gateways for its Machines, which KARL MAYER STOLL
will now replace by one or more k.ey device(s) to adapt to­increased performance requirements on the part of the KARL
MAYER Group.
On the software side, KARL MAYER STOLL will in future provide the Customer with various cloud-based communicationand support options (“Solutions”) via a platform (the “Platform”, also called “myKM.ON”) as part of package offers(“Connectivity Packages”).
Services which KARL MAYER STOLL will provide according tothis Agreement will partly be provided by other companies of
the KARL MAYER Group, in particular by the KM.ON GmbH.
The Parties are aware that it may become necessary, at any
time, to adapt this Agreement because of the dynamic
develop­ments within the field of the “Industry 4.0”.
A.
General regulations; Solutions; Use of the Platform

1.	
1.1

Solutions; Platform
The Customer can obtain services of the KARL MAYER Group
via the Platform. For the purchase of goods and services fromother companies of the KARL MAYER Group as well as via theweb shop, separate respective provisions referenced there
apply. The Customer can view the respective status of the
Solutions booked with the Connectivity Packages on the Platform.

2.	Confidentiality
2.1 In the course of the contractual relationship between the
Customer and KARL MAYER STOLL, information to be kept
confidential will be disclosed and exchanged. “Confidential­Information” comprises(a) all information of an economic, commercial, technical orother confidential nature, in particular all specifications,­descriptions, sketches, drawings, designs, sections, samples,data, inventions, formulae, procedures, plans, programmes,
models, findings, experience and know-how (relating to thek.ey device, for example);(b) the contents of this Agreement and the Solutions provided
under other agreements and as part of the Connectivity Packages;(c) Functioning, layout and design of the area of the Platform
accessible only to the Customer;(d) Information that KARL MAYER STOLL expressly designates
as confidential, with the exception of information that falls
under Section 2.5.
2.2 The Parties shall not disclose the Confidential Information or
make it accessible to third parties. Copies may be made only
for proprietary use; all Confidential Information must be
stored in such a way that third parties cannot gain knowledgeof it.
2.3 The Customer shall use the Confidential Information exclusively for the use of the k.ey devices, Platform and Solutions,but not for other business purposes, in particular not for its
own Platform-related projects; to develop products similar to
the k.ey devices, Platform and Solutions; or to promote Platform-related projects or develop third party products similar
to the k.ey devices, Platform and Solutions.
2.4 The confidentiality obligations stipulated according to Section
2.2 and 2.3 shall apply – without prejudice to the provision inpage 3 / 21

2.5

2.6

3.	
3.1

3.2

3.3

Section 2.5 – without limitation as to time and place. In particular, they shall also apply after the end of the contractual
relationship based on the Agreement.
The confidentiality obligations do not apply to knowledge orinformation(a) that was already obvious or known to the general public
at the time of their communication to the Customer or to
KARL MAYER STOLL;(b) that was already known at the time of the disclosure to
the person receiving the information;(c) that subsequently becomes obvious or known to the general public or state of the art, without any responsibility on
the part of the person who originally received the Confidential
Information;(d) that was disclosed or made accessible to KARL MAYER
STOLL or the Customer by a third party authorised to do so;(e) to whose transfer, disclosure or provision to third parties
KARL MAYER STOLL or the Customer has previously consented in writing;
The burden of proof for the existence of an exception according to the provisions of this Section shall be on the person
who invokes the existence of the exception.
During the term of this Agreement and after its termination,
the Customer and KARL MAYER STOLL shall not reverse­engineer, analyse and/or reconstruct Confidential Informationthat has been disclosed to them (ban on reverse engineering).
Rights to data; Processing of data; Protection of secrets
KARL MAYER STOLL is entitled to use the non-personal data
received from the Customer during the term of this Agreement in connection with the business relationship. This data
includes, exemplarily but without limitation, machine data(such as usage type and duration, load, condition, and status
and error messages), environmental data (temperature,­humidity, and air pressure) and machine-related network data(access, bandwidth usage, communication, and interaction)and k.ey device-related data (network information, access­information, and utilisation) (collectively the “Delivery Data”).
The Customer hereby grants KARL MAYER STOLL and all theentities of the KARL MAYER Group the worldwide, exclusive,
irrevocable, sublicensable right to use the Delivery Data­anytime and anywhere, with no restrictions of content. This
includes in particular the right to access the Delivery Data­regardless of their storage location, to process them, and to
store them beyond the termination and/or expiry of thisAgreement. In particular, the Customer acknowledges that
KARL MAYER STOLL and all the companies of the KARL
MAYER Group may(a) access the Delivery Data regardless of the data’s location(Machine, k.ey device, the Customer’s network, Platform, ortransmission paths);(b) evaluate Delivery Data with algorithms and train machinelearning models;(c) use Delivery Data for advertising and marketing purposes;(d) provide other companies of the KARL MAYER Group with
the Delivery Data;(e) provide suppliers of KARL MAYER STOLL with Delivery
Data to the extent that their respective supplier products(components, software, etc.) are affected by the Delivery Data.
With this Agreement, the Customer also expressly grants therights specified in Section 3.1 and 3.2 to the KM.ON GmbH,registered in the Commercial Register of the Local Court ofFrankfurt am Main under HRB 110267.

3.4

3.5

3.6

The Customer may use the Delivery Data itself to achieve thepurposes of use described in this Agreement in accordancewith the following conditions, insofar as the Delivery Data isprovided to the Customer by KARL MAYER STOLL. The Customer shall not transfer the Delivery Data to any third party
for independent use. In particular, the Customer shall not­provide the Delivery Data to any competitor of KARL MAYER
STOLL or any competitor of the companies of the KARL­MAYER Group. The Customer shall not extract or reuse­content from the Platform and the Solutions without KARL
MAYER STOLL’s express written consent.
The servers used by the KARL MAYER Group are secured inaccordance with the state of the art, particularly by firewalls.
Each time KARL MAYER STOLL uses cloud services for thefulfilment of this Agreement, it shall make sure or cause a
relevant company of the KARL MAYER Group make sure, as
far as reasonable, that the respective cloud services ensure
they use servers which are protected according to the state of
the art. KARL MAYER STOLL may rely on statements regarding the safety and performance of the respective service­providers and is not required to perform its own technical inspection. Applicable data protection law remains unaffectedby this.
KARL MAYER STOLL and the Customer acknowledge that,to the best of their knowledge, the Delivery Data transmitted
within the scope of this Agreement (via the Platform or thek.ey device, for example) do not contain any personal data.
­Insofar as and to the extent that KARL MAYER STOLL and/or
any company of KARL MAYER Group is subject to the European General Data Protection Regulation (EU Regulation
2016/679; “GDPR”) and collects the Customer’s personal
data in the sense of Art. 4(1) GDPR (“Personal Customer
Data”) in connection with the provision, operation, supportand maintenance of the Solutions and the Platform, KARL
MAYER STOLL does so or causes the company do so on behalf of the Customer (cf. Art. 28 GDPR) in accordance with theprovisions set forth in more detail in Appendix 2. With regard
to Personal Customer Data, the Customer remains “master ofthe data” in the sense of data protection law. The Customer is
responsible for the lawfulness of the processing of the Personal Customer Data in accordance with the order (cf. Art.
4(7) GDPR). Insofar as KARL MAYER STOLL and/or any company of KARL MAYER Group collects the Customer’s personal
information in the sense of Article 2, Section 1 of the Act on
the Protection of Personal Information (“Japanese Personal
Customer Information”) in connection with the provision,­operation, support and maintenance of the Solutions and the
Platform, KARL MAYER STOLL does so or causes the company do so on behalf of the Customer (cf. Article 25 of the Act)in accordance with the provisions set forth in more detail in
Appendix 3.

4.	Information on Solutions and k.ey devices; Quality
specifications; Product information and labelling
4.1 Product documents, illustrations, details of performance,
weights and dimensions are as accurate as possible. Unlessotherwise stated or agreed, these only represent approximate
values and, in particular, do not constitute a statement ofcondition or a guarantee.
4.2 Any legally required labels (such as CE or WEEE labels) on or
relating to the Solutions or k.ey devices, as well as batch
numbers or other identification features, do not constitutequality specifications or guarantees vis-à-vis the Customer,

page 4 / 21

4.3

5.	
5.1
5.2

5.3
5.4

5.5

5.6

5.7

5.8

5.9

6.	
6.1

6.2

but are affixed by KARL MAYER STOLL on the basis of statutory provisions in compliance with KARL MAYER STOLL’s or
the KARL MAYER Group company’s regulatory obligations.
The Customer shall read all relevant product information
carefully before using the Solutions and the k.ey devices andshall use the Solution and the k.ey devices with due care.
Liability; Limitation of liability; Statute of limitations
Unless this Agreement states otherwise, the liability provisions of this Section 5 shall apply.
KARL MAYER STOLL is liable only for intent and gross negligence as well as for the breach of a material obligation, thecompliance with which is essential for the implementationof this Agreement and on the compliance with which the­Customer may rely (“Cardinal Duty”).
KARL MAYER STOLL is not liable for subcontractors, as they
do not act as vicarious agents.
If a Cardinal Duty is breached through ordinary negligence,
the liability of KARL MAYER STOLL is limited to damage thatwas foreseeable when the Agreement was concluded and istypical of this type of agreement.
KARL MAYER STOLL is not liable for breaches through ordinary negligence of a secondary obligation that is not a Cardinal Duty.
KARL MAYER STOLL is liable for initial impossibility only if it
knew (or KARL MAYER STOLL’s lack of knowledge is basedon gross negligence), of the impossibility to perform, or if theinitial impossibility is a breach of a Cardinal Duty.
KARL MAYER STOLL is liable for defects that exist when theAgreement is concluded only if (i) it knew (or KARL MAYER
STOLL’s lack of knowledge is based on gross negligence)about the defect or (ii) KARL MAYER STOLL is responsible forthe existence of the defect when the Agreement is concluded.
Insofar as the liability of KARL MAYER STOLL is excluded orlimited, the liability for culpability of that Party’s representatives, employees and vicarious agents is also limited or excluded.
With the exception of claims in tort, the Customer’s claims fordamages for which KARL MAYER STOLL’s liability is limited
according to this Section 5 shall become time-barred afterone (1) year calculated from the statutory commencement of
the limitation period.
Service provision by the KARL MAYER Group; Transfer
In order to provide the Customer with the benefits of a single
point of contact, KARL MAYER STOLL is the Customer’s contract partner with respect to the services under this Agreement. Particularly regarding the provision of individual software components contained on the k.ey device and regarding
the services included in the Connectivity Packages, however,
KARL MAYER STOLL cannot take action itself. Due to thestructure and organisation of the KARL MAYER Group, individual companies of the KARL MAYER Group and/or suppliersof the KARL MAYER Group take action. The Customer therefore consents to the direct provision of services by companiesof the KARL MAYER Group and by suppliers of the KARL
MAYER Group.
KARL MAYER STOLL may transfer the rights and obligations
under this Agreement to third parties, be replaced as a contracting party, and withdraw from the Agreement (“Transfer”), and, unless the Customer objects to a Transfer pursuant
to this Section 6.2 within fifteen (15) business days from the
day when KARL MAYER STOLL notifies the Customer of such

Transfer, the Customer agrees with such Transfer. The Customer may object to a Transfer if good causes to oppose such
Transfer are present. A good cause is given if the interests of
the Customer are endangered by the Transfer to such an­extent that it becomes unreasonable for the Customer to­adhered to the Agreement in case of a Transfer. A Transfer of
KARL MAYER STOLL to a company of the KARL MAYER
Group shall not be construed as good cause according to thesentence before.
7.	Applicable law; Arbitration clause; Severability clause;
Singular and plural formulations; Contract amendments
and written form
7.1 This Agreement shall be governed by the laws of Japan excluding the United Nations Convention on Contracts for theInternational Sale of Goods (CISG) and the conflict of laws
rules.
7.2 The registered office of KARL MAYER STOLL as shown in thecommercial register is the exclusive place of performance forall delivery and payment obligations.
7.3 All disputes arising out of or in connection with the present
Agreement shall be finally settled under the Rules of Arbitration of the International Chamber of Commerce (ICC). The
place of arbitration shall be Fukui-City, Japan. The arbitral­tribunal shall consist of one (1) sole arbitrator for amounts indispute up to EUR 400.000,00 (including) and three (3) arbitrators for greater amounts in dispute. The language of theproceedings shall be English. The applicable law in the­matter shall be the laws of Japan to the exclusion of privateinternational law and other conflict of law provisions.
7.4 If any provision of this Agreement is or becomes invalid, unimplementable or unenforceable in whole or in part (“Defective
Provision”), the validity and enforceability of the remaining
provisions shall not be affected. Rather, the Parties undertaketo replace the Defective Provision with a provision that comesas close as possible to what the Parties would have agreed inaccordance with the meaning and purpose of this Agreement
if they had recognised the defectiveness of the provision. If
the defectiveness of a provision is based on ascertaining acertain level of performance or a certain point in time (deadline or fixed date), the provision shall be deemed to be agreed
with that level or point in time which comes as close as thelaw allows to the original level or point in time. The same
­applies to any gap in this Agreement.
7.5 An invalid provision shall be replaced by a valid provision thatcomes closest to the intended economic purpose. The same
shall apply if the implementation of this Agreement reveals a
gap that needs to be filled.
7.6 Terms and definitions in the singular include the corresponding definitions and terms in the plural and vice versa.
7.7 Individual Agreements made in individual cases between the
Customer and KARL MAYER STOLL (including ancillaryagreements to this Agreement) take precedence over thisAgreement. For the content of such agreements, a writtenagreement or the written confirmation of KARL MAYER
STOLL is decisive – subject to proof to the contrary. All legally relevant declarations and notifications by the Customer inconnection with this Agreement (e.g. setting of deadlines,­notifications of defects, withdrawal, termination or reduction)must be made using the written form, i.e. in writing or text
form (e.g. letter, e-mail, fax), unless another form is agreed inthis Agreement, for example with regard to declarations via
the Platform.

page 5 / 21

B.
Provision and maintenance of the k.ey device
8.	
8.1

8.2

Subject of the Agreement
This part of the Agreement governs the provision of the k.ey
devices by KARL MAYER STOLL and the obligations arising
for the Parties in this context.
In order to use the Platform and to provide the Solutions inaccordance with the Connectivity Packages, the Customer’s
Machines must be connected to the internet via a k.ey device.

9.	Hardware-related obligations and rights of KARL MAYER
STOLL within the scope of the transfer of the k.ey device
9.1 KARL MAYER STOLL shall transfer the required number ofk.ey devices to the Customer free of charge. KARL MAYER
STOLL shall provide the software belonging to the k.ey device
on a temporary basis in accordance with the Section 10.
9.2 KARL MAYER STOLL shall at its own dutiful discretion determine the number of k.ey devices required by the Customer.
The number depends on the number, type and use of the­Networkable Machines.
9.3 KARL MAYER STOLL may exchange k.ey devices for newer
versions or another comparable product during the term of
the Agreement. KARL MAYER STOLL will announce an­exchange with reasonable notice (one week). The Customer
shall grant KARL MAYER STOLL access to the affected­Machines and k.ey devices during the Customer’s normal
business hours.
10.	Software-related obligations and rights of KARL MAYER
STOLL within the scope of the transfer of the k.ey device
10.1 KARL MAYER STOLL shall provide the Customer with thesoftware belonging to the k.ey device temporarily and free ofcharge for the term of the Connectivity Packages according toAppendix 1.
10.2 KARL MAYER STOLL shall grant the Customer the non-exclusive, non-transferable and non-sublicensable right, limited
in time to the term of the Connectivity Packages according
to Appendix 1 and in place to the installation site of the­Machines to be networked via k.ey device, to use the software
to achieve the contractual purpose of this Agreement.
10.3 KARL MAYER STOLL is entitled to make changes and adjustments to the software as well as to replace individual (software) components both by means of remote maintenance­access and by replacing the k.ey device, in particular,(a) insofar as KARL MAYER STOLL and/or a company of the
KARL MAYER Group is obliged to do so on the basis of its own
licence and/or contractual software agreements;(b) if such modification or adaptation is necessary for the
maintenance of the software in accordance with the state of
the art; or(c) a further development, improvement, upgrade or new­release status of the software or individual (software) components is available.
11.	Obligations of the Customer within the scope of theprovision and maintenance of the k.ey device
11.1 The Customer shall accept the k.ey devices provided in­accordance with Section 9.1 and put them into operation
promptly.
11.2 The Customer shall handle and operate the k.ey devices provided in accordance with Section 9.1 carefully and in accordance with the instructions of KARL MAYER STOLL, with theCustomer’s normal diligence, but at least with the diligenceof a prudent merchant.
11.3 If the Customer does not comply with the standard of care set
out in Section 11.2, it shall bear the expenses incurred by
KARL MAYER STOLL and/or a company of the KARL MAYER
Group for inspecting a k.ey device (and the costs for a new
k.ey device, if the Customer requests one).
12.	No warranty extension through surrender of the k.ey
device; Liability
12.1 The delivery of the k.ey device shall not affect any warranty
claims still existing at the time of commissioning of the k.ey
device from the separately concluded purchase contract(s)for the Machine(s), whose scope of delivery included the­previous gateway, which is now replaced by the k.ey device,and shall also not establish any new warranty claims for the
Machine(s). The foregoing shall apply mutatis mutandis tocontracts of sale of the individual gateway which have not­included delivery of machinery.
12.2 Deviating from Section 5, the following liability and warranty
provisions shall apply to the transfer of k.ey devices:(a) KARL MAYER STOLL is responsible only for intent andgross negligence.
(b) KARL MAYER STOLL is not required to pay interest on­arrears.
(c) KARL MAYER STOLL is liable only for material defects
and defects of title that KARL MAYER STOLL has fraudulently
concealed from the Customer.
(d) Warranty claims with regard to the k.ey device shall become time-barred one year after the date of commissioningof the k.ey device, but not later than the expiry of the eighteenth (18th) month after delivery of the k.ey device to the­Customer’s place of business.
C.
Connectivity Packages
13.	 Object of the Connectivity Packages
13.1 The object of the Connectivity Packages are various Solutions
that the Customer can access via the Platform with the helpof an internet-enabled smartphone or computer.
13.2 The content and scope of the Connectivity Packages, such as
possibly included Solutions, are set out in Appendix 1 to thisAgreement. Machine-related support and maintenance­contracts are to be concluded separately with regard to the
Machine’s hardware components. Such support and main­
tenance contracts and/or respective repair and service works
are not included in the Connectivity Packages and not the­object of the Solutions but are governed by the purchase orservice contract for the Machines or hardware components.
14.	 Customer’s obligations
14.1 The Customer shall be responsible for providing all necessary
information as well as for providing and maintaining the hardware and network environment as well as the necessary system environment; the Customer shall oblige its users accordingly. The hardware and network environment requirements
are set out in Appendix 1 Annex B, unless otherwise stipulated in this Agreement. For the installation and maintenance of
the k.ey devices, the Customer shall grant KARL MAYER
STOLL access to the installation site of the k.ey devices­during normal business hours after KARL MAYER STOLL has
given reasonable notice in advance.

page 6 / 21

14.2 If the Customer does not fully comply with its cooperation­obligations, KARL MAYER STOLL shall become free from its
obligations arising from this Agreement until the Customer
has duly fulfilled its cooperation obligations, insofar it is significant for the obligations of KARL MAYER STOLL that theCustomer fulfils the respective cooperation obligation. If
KARL MAYER STOLL or a company of the KARL MAYER
Group incurs additional expenses due to a breach of the­Customer’s cooperation obligations, the Customer is obliged
to reimburse these expenses.

(timely) delivered. If it is certain that KARL MAYER STOLL has
not been supplied with the Solutions it has ordered or withthe supplier products and services required for the production
or provision of the Solutions, despite the conclusion of a­congruent covering transaction, for reasons for which it is not
responsible, KARL MAYER STOLL may terminate the Agreement. Any statutory rights of withdrawal and termination
shall remain unaffected.
17.5 Early or partial deliveries are permissible unless they are­unreasonable for the Customer.

15.	 Obligations of KARL MAYER STOLL
15.1 KARL MAYER STOLL shall provide and maintain the Connectivity Packages described in Appendix 1 with the content andscope defined therein and shall keep it in orderly condition toprevent malfunctions or shall repair it in case of malfunctions.

18.	Notice of defects; Claims for defects; No right ofwithdrawal; Use of the Remote Service Connection
18.1 Deviating from Section 5, the following provisions of this­Section shall apply to the Solutions to be provided according
to the Connectivity Packages.
18.2 The Customer shall inspect the k.ey devices and Solutions
immediately after delivery or provision and – if foreseen by
KARL MAYER STOLL in the individual case – test them. The
k.ey devices and the Solutions shall be deemed to have been
approved by the Customer if the Customer has not notified
KARL MAYER STOLL of a defect (i) in the case of obvious­defects without undue delay, but at the latest within seven (7)calendar days after delivery or provision of the Solution to theCustomer or (ii) in the case of hidden defects also without­undue delay, but at the latest within ten (10) calendar days
­after discovery of the defect.
18.3 If within the framework of this Agreement KARL MAYER
STOLL is owed the provision or transfer of a service or anitem temporarily, and a defect arises during the term of theAgreement, the Customer shall notify KARL MAYER STOLLof the defect within seven (7) calendar days after it arises.
18.4 The Customer must describe defects in detail so that KARL
MAYER STOLL is able to identify and remedy the defect.
18.5 With this Agreement, the Customer and KARL MAYER STOLL
are driving forward the digitalisation of the industry. The Customer will notify KARL MAYER STOLL of a defect exclusively
by using the Remote Service Connection. For this purpose,
the Customer shall comply with the process set out in­Appendix 1 for making warranty claims and for other main­
tenance requests. The Customer shall use this process for all
defects and regarding all support or maintenance requests
with regard to the Solutions, the k.ey devices and the Networked Machines.
18.6 If there is actually a defect and the Customer gives notice of
this defect in due form and time in accordance with Sections
18.2 to 18.5, KARL MAYER STOLL is initially obliged, at its
own discretion, to rectify the defect or to deliver or provide a
defect-free Solution (subsequent performance).
18.7 If KARL MAYER STOLL takes action on the basis of a notice of
defect without a defect having existed, the Customer shallcompensate KARL MAYER STOLL separately for any expenses
incurred.
18.8 With the exception of claims for damages due to defects,
claims based on defects shall become time-barred twelve(12) months after delivery or provision of the Solutions to theCustomer.
18.9 The Customer is entitled to claims for damages due to defects only insofar as the liability of KARL MAYER STOLL is not
excluded or limited in accordance with Section 18.1 to 18.8.
18.10 The provisions of this Section 18 do not affect claims for defects which KARL MAYER STOLL has fraudulently concealedor which are covered by a guarantee of quality or durability.

16.	 Default in payment; Setoff; Right of retention
16.1 During the default of payment of the Customer, KARL MAYER
STOLL is entitled to claim the statutory default interest in theamount of currently nine (9) percentage points above the­respective base interest rate as well as a lump sum in theamount of EUR 40.00. KARL MAYER STOLL reserves theright to claim higher damages for delay.
16.2 The Customer may set off his liabilities only against a counterclaim that has become res judicata, is ready for a decision,or is uncontested.
16.3 The Customer may assert a right of retention only insofar as
its counterclaim is determined with legally binding effect,
ready for a decision, or uncontested, and is based on thesame contractual relationship.
17.	Delivery time; Force majeure; Reservation of self-delivery;
Early or partial deliveries; Amendments
17.1 KARL MAYER STOLL must confirm delivery and provision
deadlines in writing in order for them to be binding. Delivery
and provision periods shall commence on the date of the­order confirmation, but not before complete clarification of
all details of the order and not before timely fulfilment of thecontractual obligations of the Customer, in particular with­regard to the hardware and network environment to be provided by the Customer.
17.2 If KARL MAYER STOLL is in default with the delivery or provision, the Customer must grant KARL MAYER STOLL a reasonable period of grace, which may not be less than two (2)weeks. The Customer is only entitled to withdraw from or terminate the Agreement, if this grace period expires to no avail.
17.3 Force majeure (including without limitation an act of God, war,riot, civil war, strikes, pandemics, epidemics (including unforeseeable events with regard to COVID-19), enactment, revision
or abolishment of any law or regulation, accident or difficultywith communication lines, limited supply of electricity, cyberterrorism, instruction or request from a governmental agency,
or any other event not attributable to a party) that prevents
KARL MAYER STOLL from delivering or providing throughno fault of its own will result in an extension of the relevantdelivery or provision period for as long as this circumstancepersists. If a delivery becomes unreasonable due to these­circumstances, KARL MAYER STOLL may terminate theAgreement.
17.4 If KARL MAYER STOLL does not receive its own deliveries ordoes not receive them on time, it will not be deemed in default unless KARL MAYER STOLL is responsible for not being

page 7 / 21

List of Appendices and Annexes
Appendix 1 Content and scope of the Connectivity Packages
Annex A Product data sheet; k.management; Dashboard
Lite
Annex B Hardware requirements, network requirements
and necessary system environment
Annex C Service Level Agreement – Dashboard Lite and Remote Services
Appendix 2 Agreement on Commissioned Data Processing (Art.
28 GDPR) with associated annexes
Annex 1 Technical and organisational measures
Annex 2 Authorized sub-processors
Appendix 3 Terms and conditions in relation to the Act on theProtection of Personal Information and other data laws andregulations related to data protection in Japan

Appendix 1:
Content and scope of the Connectivity Packages
Summary Framework Connectivity Packages
Costs

EUR 15.00 net per Networked Machine per month formechanical machines (N-drive).
EUR 22.00 net per Networked Machine per month forelectronic machines (ON, EL, EN drive, etc.) with bidirectional
data transfer

Term

Beginning with registration of the Machines on the Platform for
the Connectivity Packages, but no later than three (3) months
after the Customer has received the order confirmation or any
other confirmation leading to the conclusion of the Agreement:
Twelve (12) months (“Accounting Year”).
The Agreement will renew tacitly for twelve (12) months eachtime if no notice of termination is given.

Termination

The Agreement may be terminated through ordinary
termination at the end of any month with three (3) months’
notice.
Termination for good cause remains unaffected fromprovisions herein.

Invoicing

Per Accounting Year (12 months).

Payment

Bank name: Mizuho Bank, Fukui Branch (みずほ銀行／福井支店)
Address: 3-5-1, Ohte, Fukui City, 910-0005 (福井市大手3-5-1)
SWIFT CODE: MHCBJPJT
Account type : Checking account (当座預金)
Account number : 0102800
Account holder : Nippon Mayer Ltd. (ニッポンマイヤー（カ)Payments in the year the Agreement is concluded by cash inadvance, in the further Accounting Years annually after
invoicing and according to the due date stipulated in theinvoice by KARL MAYER STOLL at the beginning of the
Accounting Year; the timely receipt of payment on the accountof KARL MAYER STOLL is decisive for timely payment by the
Customer.

Price adjustments

KARL MAYER STOLL may notify the Customer of priceadjustments four (4) weeks before the expiry of the ordinary
termination period. If the Customer stays silent to such
notification, the price adjustment shall be deemed to have been
approved by the Customer. KARL MAYER STOLL will point out
this approval by staying silent in the price adjustment letter.
If the producer price index determined by Consumer Price Index
2020-Base Consumer Price Index Monthly Report | File |Browse Statistics | Portal Site of Official Statistics of Japan(e-stat.go.jp)changes by more than ten (10) per cent comparedto the level in the first month of the closing year, the costs per
Networked Machine according to this table shall automaticallychange, without the need for a request, by seventy (70) per centof the index change that has occurred. The price changes fromthe beginning of the next month following the first attainmentof the percentage change, for the first time at the beginning of
the first Accounting Year. If the price change leads to a short orover payment by the Customer, KARL MAYER STOLL will settle
this by invoice.
The right of KARL MAYER STOLL to terminate the Agreement
due to changes remains unaffected.

Components of theConnectivity Packages

k.ey device(s), if required, see Section 9 of the Agreement.
SaaS solution Dashboard Lite, in accordance with Section 19 of
this Appendix 1.
Remote Service Connection, in accordance with Section 20 of
this Appendix 1.
Remote Set-Up and Installation Support for Connectivity, in
accordance with Section 21 of this Appendix 1.

Hardware requirements, Annex B
network requirements,
and necessary system
environment

page 8 / 21

19.	 SaaS Solution Dashboard Lite
Specifications for the content and scope of the Dashboard Lite
Software-as-a-Service Solution are set out in Annex A to thisAppendix 1. Service Level Specifications relating to the Dashboard
Lite are set out in Annex C to this Appendix 1. Services under theService Level Agreement set out in Annex C to this Appendix 1 shallbe provided by KM.ON GmbH.
20.	 Remote Service Connection
20.1 The Customer shall follow the following process when making warranty claims and otherwise requesting maintenance:• Step 1: The Customer triggers a service request with KARL
MAYER STOLL via the myKM.ON Platform. There is a­“Remote Service” button on the Platform for this purpose.
After its activation, the Customer is shown all the Machines
for which it has entered into a Connectivity Packages.
• Step 2: The Customer generates a ticket at KARL MAYER
STOLL and confirms the permission of the companies of
the KARL MAYER Group for remote access with regard to
the Networked Machines concerned.
• Step 3: The Customer accepts the feedback from the­service-providing unit of a company of the KARL MAYER
Group. Service Level Specifications relating to the Dashboard Lite are set out in Annex C to this Appendix 1.
20.2 The access authorisation regarding Networked Machines
within the scope of the Remote Access is not limited to KARL
MAYER STOLL. The Customer grants access to its Networked Machines to each company of the KARL MAYER
Group and, to the extent necessary, to its suppliers, if any.
This access authorisation is a necessary prerequisite for therespective company of the KARL MAYER Group to be able tofulfil warranty claims or maintenance orders requested by
the Customer.
20.3 The Remote Service Connection does not include any troubleshooting/maintenance or repair service by KARL MAYER
STOLL, but creates the prerequisite for a company of the
KARL MAYER Group to be able to provide the Customer withthe services contractually owed by other contracts that may
have to be concluded (e.g. remote instructions for troubleshooting within the scope of the warranty or outside of thewarranty (separate service subject to a charge).
21.	 Remote Set-Up and Installation Support for Connectivity
21.1 KARL MAYER STOLL provides remote support for networking
the Networkable Machines for which the Connectivity Packages exists. KARL MAYER STOLL will instruct the Customer
remotely on how the Customer can establish a connection of
the k.ey device with the Machines to be networked and the
Platform. Included in Remote Set-Up and Installation Support
for Connectivity is support by phone, email or chat (Microsoft
Teams) from service representatives. KARL MAYER STOLL is
not oblige to directly connect to the Networkable Machinesconcerned via Remote Access.
21.2 To enable a company of the KARL MAYER Group to provide
the service described in Section 21.1 of this Appendix 1, KARL
MAYER STOLL and the Customer will arrange an appointment. KARL MAYER STOLL shall respond to the Customer’s
appointment request within one (1) working day (by e-mail /telephone).

Annex A:
Product data sheet; k.management; Dashboard Lite
Preliminary remarks: What follows is an abstract scope of services
for the “Dashboard Lite” Solutions, which belongs to the k.management. Whether the Solutions described herein are available to theCustomer shall be determined by the specific agreements on thecontent and scope of the Connectivity Packages in Appendix 1 tothis Agreement.
1.	
1.1

1.2
1.3

1.4

2.	

2.1

2.2

2.3

2.4

page 9 / 21

Dashboard Lite – Overview
Dashboard Lite is a cloud-based k.management Solution
within the Machine data visualisation Platform (“Dashboard
Lite” or “Dashboard”).
Access to the dashboard is browser-based via login throughthe myKM.ON Platform.
Displayable are, in principle, processed machine data from
Networkable Machines. Details of the hardware requirements
and network requirements are set out in Annex B to thisAgreement’s Appendix 1. On the landing page of the Dashboard, all Networkable Machines that the Customer has networked via the k.ey device (the “Networked Machines”) aredisplayed as an overview (the “Overview Page”).
The Dashboard Lite is available for Warp Knitting KAMCOS 1
and KAMCOS 2 systems. To the extent that functionalities differ with respect to individual Networked Machines, such differences shall also result from the specifications in Section 2of this Annex A.
Specification and description of the Dashboard Lite
Where a Machine is covered by this Section, the Dashboard
Lite shall include the following functions:
Overview of all Networked Machines
In Dashboard Lite, the Overview Page displays the following
Machine information of all Networked Machines as live dataat the respective displayed Networked Machine:• Machine name as stored in the respective KAMCOS system;• Machine status (running, stopped, or offline);• Remaining time until the source material is completely­processed;• Remaining time until completion of the piece currently in
production;• Number of stops during the production of the current piece;• Percentage information on the running time of the respective Machine in production operation in the last 24 hours(rolling: e.g. 11.01. 15:00 until 12.01. 14:59).
Filter function
By using the filter function “Machine status (running, stopped,
or offline)”, the Networked Machines can be filtered accordingly
on the Overview Page. It is also possible to filter individual
Networked Machines on the Overview Page by entering themachine name or the serial number of the respective Net­
worked Machines.
Sorting functions
The Customer can sort all Networked Machines on the Overview Page by “Machine name A–Z”.
Individual evaluation of the live data of a Networked Machine
By clicking on a specific Networked Machine on the Overview
Page, the following further information on the specific Networked Machine can be called up as live data:• Information on the Networked Machine itself (machine type,serial number, total operating hours and version of the
KAMCOS system);2.5• Production output for the piece currently in production (inlength / time unit);• Current speed of the Networked Machine in production (inrevolutions / time unit);• Selected information about the Customer’s order currently
being produced on the Networked Machine (e.g. Customer’s
article and order number; number of pieces per order). The
prerequisite is that this information has been entered in therespective KAMCOS system beforehand, whereby there
may be restrictions depending on the KAMCOS system (e.g.
order data not possible with KAMCOS 1);• Information on the warp beams of the respective Networked Machine;• Information on goods take-off and roll-up.
Statistics function
In addition, it is possible to retroactively evaluate historical
production data of the concrete Networked Machine (the“Statistics Function”). The Statistics Function contains a­historical overview of the “Machine status (running, stopped,
or offline)” of the respective Networked Machine, whereby thefollowing time periods can be selected:• Last 1 h;
• Last 8 h.

Annex B:
Hardware requirements, network requirements, and necessary
system environment
1.	

k.ey device
The platform requires a properly connected and functioning
k.ey device in order to interact with Networkable Machines.
The k.ey device:(a) Technical data k.ey device:(i)	Dimensions and weight:
Dimension: 180 x 134 x 50 mm
Weight: approx. 1.0 kg(ii)	Operating conditions:
The installation site of the k.ey device must be chosen
so that it is operated under IT conditions.
This particularly concerns the following requirements:
Operating temperature: 0–40 degrees Celsius;
Relative humidity: 10–90% at 39 degrees Celsius(non-condensing).
(b) Network requirements
The trouble-free operation of the k.ey device requires that theCustomer maintains the following minimum requirements onsite continuously (24/7) and provides the hardware components required for this purpose, which are not included in thescope of delivery of the k.ey device, at its own expense.
(i) General requirements (LAN and WLAN):• CAT-5e cable (or higher category);• Machine network (LAN), Ethernet recommendation,
WiFi optional;• Internet router / internet connection;• Configure the firewall to reach the required hosts/ports.
The software required for this is currently available in
the Quick Start Guide;• DNS server;• IP address range (LAN and WLAN);• Recommended: Static IP address assignment for k.ey
device and Machines to be networked.

(ii) Special requirements:	Depending on the type of networking chosen, the Customer
must also meet the following requirements.
(A)	Networking via LAN connection (recommended by
KARL MAYER):
		 •	Access to the internet via LAN 1 (WITH network
separation) or LAN 3 (WITHOUT network separation) in the k.ey device permanent access tothe internet via LAN 3;		 •	Access to the Machine network via LAN 1 (withnetwork separation) or LAN 3 (without network
separation);		 •	Unrestricted internet access of the k.ey device
with a bandwidth of at least 10 Mbit/s.
		•	Network cable:			 • LAN cable from machines to switch;			 • LAN cable between switch and k.ey device;			 • LAN cable from the k.ey device to the internet
router.
		 • Other hardware:			 • If necessary, LAN adapter (for KAMCOS 1­machines, for example).
(B) Networking via WLAN connection		 •	Access to the internet via LAN 1 (WITH network
separation) or LAN 3 (WITHOUT network separation) in the k.ey device.
		 •	Unrestricted internet access of the k.ey device
with a bandwidth of at least 10 Mbit/s.
		•	Network cable:			 • LAN cable between WLAN antenna andswitch;			 • LAN cable between switch and k.ey device;			 • LAN cable from the k.ey device to the internet
router.
		 • Wifi equipment:			 • WLAN antenna/s (WLAN access point).
		 • Other hardware:			 • If necessary, WLAN antenna for KAMCOS 1 &KAMCOS 2 Machines (local on the Machine).
(c) Software
As delivered, the k.ey device is equipped with a Linux operating system and pre-installed basic software to ensure operation and maintenance of the k.ey device. The provisions ofSection 10 of this Agreement shall apply to the software, inparticular its transfer.
(d) Electrical equipment:• Power supply unit: 110 V /230 V• Supply input: 100–240 VAC• Frequency of supply: 50 Hz / 60 Hz• DC output: 24 VDC(e) Interfaces:• 1 x HDMI / 1 DP (Display Port)• 4 x USB 3.0• 2 x RJ 45 (10/100/1000)• 1 x RJ 45 (Support)(f) Initial commissioning of the k.ey device
For the initial commissioning of the k.ey device, a one-timeregistration with the personal company email address of an
employee of the customer on the myKM.ON Platform of
KM.ON GmbH is necessary (currently accessible athttps://go.kmon.net or for PRC https://go.kmon.net.cn). The
corresponding processing of Personal Customer Data is­carried out on b
­ ehalf of the Customer (see Art. 28 GDPR) in

page 10 / 21

accordance with Appendix 2, and the corresponding processing of Japanese Personal Customer Information is carried out
on behalf of the Customer (see Article 25 of the Act on theProtection of Personal Information) in accordance with
­Appendix 3. Only after this registration is it possible to­onboard the k.ey device itself and to access the Quick Start
Guide (currently available at https://go.kmon.net/key/quicstartguide) for instructions on commissioning the k.ey device.
The Quick Start Guide also contains suggestions for setting
up the network environment to be created by the Customer
as well as the URLs and ports to be released by the Customer.
For the onboarding process, the Customer needs, in addition to
the network requirements to be created by the Customer: alaptop and a LAN cable with RJ 45 connector.
General information on the k.ey device can be found athttps://www.karlmayer.com/de/key/.
2.	
Customer terminal
The Customer requires a commercially available mobile or
stationary device to access the Platform and/or Networked
Machines (such as a smartphone, laptop with active W-LAN andinternet connection) (“End Device”).
3.	Hardware requirements and network requirements related
to the Machine and Connectivity Packages, as well as thenecessary system environment
The basic prerequisite for using Solutions is the existence of a
Networkable Machine. Furthermore, depending on the Solutions
included in the respective Connectivity Packages, they havedifferent requirements.
3.1 Networkable Machine
The following Machines can be networked in principle:• Warp knitting Machines of the KARL MAYER Group, provided
they are operated with the operating system KAMCOS 1 (allversions) or KAMCOS 2 (from version V3.9.0.263).
• Possible for warp knitting Machines with the KAMCOS 1­operating system (from version V1.4.0.87), whereby additional hardware components may have to be purchased inadvance by the Customer [adapter or WiFi antennas (perMachine ­potentially to be networked)]. In addition, the Customer may have to commission a KM service technician tocarry out any necessary software updates (when operatingwith a WiFi a­ ntenna), for which a charge will be made.
• In the case of warp knitting Machines with an older­KAMCOS 1 operating system, clarify in advance with KARL
MAYER STOLL whether and under what conditions networking of the Machine is possible.
• For all other machines of the KARL MAYER Group as wellas machines from third-party manufacturers, it must be
clarified in advance with KARL MAYER STOLL whether andunder what conditions networking of the respective­machines is possible.
3.2 Dashboard Lite
The requirements for the k.ey device according to Section 1 ofthis Annex B apply.
3.3 Remote Set-Up and Installation Support for Connectivity:
The requirements for the k.ey device according to Section 1 ofthis Annex B apply.

Annex C:
Service Level Agreement – Dashboard Lite and Remote Services
1.	Scope of this Service Level Agreement – Dashboard Lite;
Relationship to the Agreement
1.1 This SLA contains specifications on the availability of the­Services provided by KARL MAYER STOLL via the myKM.ON
Platform of KM.ON GmbH, on the performance of Maintenance
Work, the Remote Services and the Incident Management.
1.2 This SLA applies exclusively to the Service made available to
the Customer for productive use and not to non-productive,
free and/or test versions of the Service and the integration or
test systems with unreleased functions.
1.3 All obligations of KARL MAYER STOLL in this SLA apply only
to the Service provided to the Customer at the Transfer Point.
KARL MAYER STOLL is not responsible for the data trans­mission from the Transfer Point to the Customer and/or in thearea of the Customer’s IT system.
1.4 In the event of any conflict between this SLA and the Agreement, the provisions of the Agreement shall prevail.
2.	Definitions
2.1 Besides the definitions in the Agreement, the definitions set
out in this Section shall apply for the purposes of this SLA. In
the event of any inconsistency between the definitions in this
SLA and the definitions in the Agreement, the definitions in
the Agreement shall prevail.
2.2 “Downtime” means the total number of hours during which
the essential functions of the Service, as defined in the contract, are not available during the system term
2.3 “Dashboard Lite” as defined in Appendix 1 Annex A.
2.4 “Incident Management” refers to the processing of Faults.
2.5 “Response Time” is the time period in which KARL MAYER
STOLL starts to process a Fault reported by the Customer.
2.6 “Remote Services” as described in Appendix 1, Section 20
and 21.
2.7 “Service” is the umbrella term for the Dashboard Lite andthe Remote Services, unless one of the two Services is­explicitly addressed in this SLA.
2.8 “Service Provision Time” as defined in Section 3.1 of this­Annex.
2.9 “SLA” This Service Level Agreement
2.10 “Fault” means any impairment of the Service, such as Downtime, errors or quality degradation.
2.11 “Transfer Point” Regarding the Dashboard Lite: Point at
which the data transfer from the Platform to the Customer’ssystem takes place. Regarding Remote Services: Point at
which the Remote Service leaves the network of KARL­MAYER STOLL or the company providing the Remote Service.
2.12 “Availability” means that the Customer can perform and use
the essential functions of the Service at the Transfer Point.
The Service is also available if the Customer can use the­essential functions of the Service by means of a work-aroundprovided by KARL MAYER STOLL at the Transfer Point.
2.13 “Maintenance Work” refers to all maintenance activities­required to keep the Service running, remedy Faults, troubleshoot the Service, back up data and/or activities required to
improve, enhance or renew functionality to ensure that theService can be used in accordance with the Agreement.
3.	Availability
3.1 KARL MAYER STOLL owes the agreed availability of the­Service at the Transfer Point. The agreed availability is 96%

page 11 / 21

3.2

3.3

3.4

3.5

4.	
4.1

per month based on a provision time of 24 hours per day and
365 days per year with respect to the Dashboard Lite andwith ­respect to the Remote Services as agreed in Section 4.1of this SLA (each the “Service Provision Time”).
3.2 KARL MAYER STOLL is not obliged to make the Service
available for use by the Customer during planned Main­
tenance Work in the Service Provision Time in accordancewith Section 6 of this SLA. If the Service is available duringscheduled Maintenance Work pursuant to Section 6, use of
the Service shall be at the Customer’s own risk. The Customer
acknowledges that the use of the Service may be limited interms of functionality or performance during scheduled Maintenance Work and/or that the Service may be shut down orrestarted without further notice. If the Service is provided
during scheduled Maintenance Work and there is a reductionin the functionality of the Service or a reduction in availability,
the Customer shall not be entitled to any warranty or compensation.
3.3 The availability of the Service is calculated as a percentage of time over the course of a calendar month during theService Provision Time.
When calculating the actual availabilities, Downtimes thatcannot be attributed to KARL MAYER STOLL are considered
as available times. These harmless Downtimes are:(a) Downtime due to planned or unplanned MaintenanceWork in accordance with Section 6;(b) Downtime due to Maintenance Work agreed in advancewith the Customer;(c) Downtimes due to operational disruptions caused by anevent of force majeure or other unavoidable events outside
the sphere of influence of KARL MAYER STOLL and which
could not be averted with reasonable effort and which could
not be foreseen even with careful application, which make theobligations of KARL MAYER STOLL under this SLA considerably more difficult or impossible in whole or in part, such as
epidemics, pandemics (including further unforeseeable
events of COVID-19), strikes, lockouts, extraordinary weather
conditions, power failures, operational or traffic disruptions
and transport hindrances, and which release KARL MAYER
STOLL from its obligations under this SLA for the duration ofsuch event;(d) Downtimes due to virus or hacker attacks, insofar as
KARL MAYER STOLL has not taken the agreed protective
measures or, in the absence of an agreement, the usual protective measures;(e) Downtimes due to a Fault caused by the Customer;(f) Downtimes due to software errors in the Customer’s applications or due to errors in the system and system-related
software triggered by the Customer’s applications or data;(g) Downtimes caused by Faults in the Customer’s hardware,with the exception of Faults in the k.ey device or in the Networked Machine;(h) Downtimes caused by third parties (persons not attributable to KARL MAYER STOLL).
The Customer must notify KARL MAYER STOLL of any impairment of the availability of the Service.

Asia (without
People’sRepublic ofChina andJapan)

People’sRepublic of
China

Japan

Rest of the world

Days

Monday–SaturdayMonday–SaturdayMonday–SaturdayMonday–Friday

Operatinghours

07:00–20:00(GMT+8)07:00–22:00(GMT+8)07:00–18:00(GMT+9)07:00–17:00(MEZ)

Language

EnglishEnglish / Chinese English

English

4.2

Support includes a service desk for Customer incident r­ eports
through tickets and emails via:connectivity-support@karlmayer.com

5.	
5.1

Incident Management
Incident Management includes all activities between the­Customer and KARL MAYER STOLL in connection with thenotification and management of Faults until their resolution.
The following Fault classes apply:(a) Faults within the Service are assigned to one of the­following Fault classes, which determine the target Response
Time.

5.2

Fault Class

Description

1
CriticalA Fault is allocated to Fault class 1 if use <12h during the Serviceof the Service or essential parts thereof Provision Time of theis completely unavailable or severely­Remote Services­restricted (due to malfunctions, ­incorrect
work results or response times, for­example).

2
Essential

A Fault is allocated to Fault class 2 if use <12h during the Serviceof the Service or essential functionalities Provision Time of theis restricted (due to malfunctions,­Remote Services­incorrect work results or long response
times, for example).

3
Insignificant

A Fault is allocated to Fault class 3 if insignificant functionalities of the Service
are impaired, such as “nice to have”­functionalities or flaws that do not­impair the use of the Service.

<18h during the Service
Provision Time of the­Remote Services

4
Low

A Fault is allocated to Fault class 4 if
use of the Service is not restricted atall (if the Customer asks questions or­requests improvements, for example).

<24h during the Service
Provision Time of the­Remote Services

5.3

Remote Services
The Service Provision Time of the Remote Services, which­depends on the location of the Networked Machine, is shownin the following table:

page 12 / 21

Response Time(b) KARL MAYER STOLL shall prioritise and classify Faults at
its own discretion, taking into account the aforementioned
definitions.
Incident Management Process(a) The Customer shall inform KARL MAYER STOLL immediately of any Faults via the Platform, email, or ticket system(depending on which option KARL MAYER STOLL offers the
Customer).
(b) The Customer shall ensure that the notification of a Fault
contains the following required information:(i)	Name of the user account and Networked Machinesconcerned as well as the Service;(ii)	Detailed description of the Fault so it can be reproduced;(iii)	Date and time when the Fault occurred;(iv)	Which troubleshooting measures have already been
carried out by the Customer and what behaviour has
been shown as a result of the Customer’s troubleshooting measures.
(c)	As soon as the Customer has provided KARL MAYER
STOLL with all the necessary information, the solution
process begins. KARL MAYER STOLL will then provide theCustomer with an initial response within the Response
Times specified in Section 5.2. KARL MAYER STOLL will
inform the Customer about the elimination of the Fault.
Faults are processed during the Service Provision Time of
the Remote Services.
6.	
6.1
6.2

6.3

6.4

Maintenance WorkKARL MAYER STOLL may interrupt the provision of the­Service for Maintenance Work.
KARL MAYER STOLL shall schedule Maintenance Work insuch a way that the Customer’s use of the Service is affected
as little as possible.
KARL MAYER STOLL shall notify the Customer of planned
Maintenance Work in the Platform at least five calendar daysin advance.
KARL MAYER STOLL may perform unscheduled maintenanceof the Service for an important reason (if the Service operationis endangered, for example). This includes without limitation
emergency changes, such as the installation of security
patches, which are necessary to secure and maintain operations and require immediate implementation. KARL MAYER
STOLL shall notify the Customer of such unscheduled Maintenance Work without delay and carry it out in such a waythat disruptions to the operating process are kept to a­minimum.

Appendix 2:
Data Processing Agreement for the Connectivity Terms andConditions (Art. 28 GDPR)
1.	
1.1

1.2

1.3

Definitions, starting point and ranking
The definitions in the Connectivity Terms and Conditions shallapply mutatis mutandis to this Appendix 2 (including the­Annexes), subject to the following variation: The Customer isalso referred to as the “Client” and KARL MAYER STOLL isalso referred to as the “Contractor”. In this Appendix 2,
KARL MAYER STOLL refers to NIPPON MAYER LTD., 27-33
Kamikitano 1-Chome, 918-8522 Fukui-City, Japan, or an affiliate or any other entity of the KARL MAYER Group, as the casemay be. The Connectivity Terms and Conditions are referred
to as the “Main Contract”.
The provision of services in the form of the provision, operation, support and maintenance of the Solutions and the Platform in accordance with the provisions of the Main Contract
requires the processing of personal data of the Customer
within the meaning of Art. 4(1) GDPR (“Personal Customer
Data”). This Appendix 2 (“Commissioned Data Processing”)
sets out, as an agreement on commissioned processing pursuant to Art. 28 GDPR between the Parties, the data protection obligations of KARL MAYER STOLL (as a processor within
the meaning of Art. 4(8) GDPR) resulting from the processingof Personal Customer Data in the context of the contractual
provision and use of the Solutions and the Platform (“Data
Processing”). As the controller, the Customer is solely­responsible for the lawfulness of the disclosure of Personal
Customer Data to KARL MAYER STOLL as well as the lawfulness of the Data Processing under the data protection laws
applicable to the Customer.
If there is any inconsistency or ambiguity between a provisioncontained in the main body of this Commissioned Data Processing and a provision contained in its Annexes, the provisioncontained in the main body shall prevail. If there are contradictions or ambiguities between provisions of this Commis-

sioned Data Processing and the provisions of the Main Contract, the provisions of this Commissioned Data Processing
shall take precedence as far as data protection matters areconcerned. If there is any inconsistency or ambiguity between
any provision of the concluded EU standard contractual
clauses and any provision of this Commissioned Data Processing (including Annexes), the provision of the EU standard
contractual clauses shall prevail.
2.	
2.1

2.2

2.3

2.4

2.5

3.	
3.1

page 13 / 21

Object, duration, and specification of the Data Processing
The object of the Data Processing is the provision, operation,
support and maintenance of the Solutions and the Platformby KARL MAYER STOLL for the Customer and its users in­accordance with the provisions of the Main Contract. The­details are specified in the Main Contract.
The term of this Commissioned Data Processing corresponds
to the term of the Main Contract. This Commissioned Data
Processing ends with the termination of the Main Contract.
The scope, type, and purpose of the Data Processing is theprovision, operation, support and maintenance of the Solutions and the Platform in accordance with the provisions of
the Main Contract by KARL MAYER STOLL as well as the en­abling of the contractual use of the Solutions and the Platform by the Customer and its users. The details are specified
in the Main Contract.
The types of Personal Customer Data and the categories ofdata subjects are as follows:(a) Types of Personal Customer Data are (a) the user’s nameand email address, (b) the user’s role with the Customer, (c)the user’s IP address, and (d) an authentication token (~ individual characteristic that identifies the user for authentication
purposes within the Solutions and the Platform).
(b) Categories of data subjects are employees and workers of
the Customer.
The Solutions and Platform is a global software solution.
Against this background, Data Processing occurs both (a)within the European Union (“EU”) or the contracting states to
the Agreement on the European Economic Area (“EEA”) and(b) outside the EU or the EEA. Data Processing outside the EU
or the EEA takes place only if the special protection provisionsof Art. 44 et seq. GDPR are fulfilled in order to ensure an adequate level of data protection. KARL MAYER STOLL sees anappropriate adequate level of data protection on the basis ofan adequacy decision of the European Commission (Art. 45
GDPR) and/or by entering into EU standard contractual clauses (Art. 46(2)(c) and (d) in conjunction with Art. 47 GDPR). If
EU standard contractual clauses are entered into, KARL
MAYER STOLL shall provide the Customer with a copy of
those clauses on request.
The retransfer of Personal Customer Data from KARL MAYER
STOLL to the Customer takes place in accordance with Art.
44 et seq. GDPR based on the adequacy decision (Art. 45
GDPR) for Japan by the European Commission.
The Customer authorises a data transfer to countries outside
the EU or EEA to the sub-processors/recipients listed in­Annex 2. Annex 2 specifies the measures approved by the
Customer to ensure an adequate level of data protection in
the context of subcontracted processing.
Technical and organisational measures
KARL MAYER STOLL takes all necessary technical and­organisational measures in its area of responsibility in­accordance with Art. 32 GDPR on the protection of Personal

3.2

3.3

4.	
4.1

4.2

Customer Data. The technical and organisational measures
are specified in Annex 1. Annex 1 shall be handed over to the­Customer for review and, if accepted by the Customer, shallbecome the basis of this Commissioned Data Processing.
Insofar as a review or inspection of the Customer reveals aneed to adapt the technical and organisational measures­listed in Annex 1, the Parties shall implement this by mutual
agreement.
The technical and organisational measures listed in Annex 1
are subject to technical progress and further development.
KARL MAYER STOLL may implement alternative adequate
measures, although the security level of the technical and­organisational measures specified in Annex 1 must be met or
exceeded. The Customer must be informed in writing or text
form of any significant changes.
Rights of data subjects
KARL MAYER STOLL supports the Customer within its areaof responsibility and as far as possible by means of suitable
technical and organisational measures in responding to andimplementing requests from data subjects under the dataprotection laws applicable to the Customer. KARL MAYER
STOLL may not disclose, port, rectify, erase or restrict theprocessing of Personal Customer Data on its own authority,
but only after receiving documented instructions from theCustomer. If a data subject contacts KARL MAYER STOLL­directly, KARL MAYER STOLL shall forward that request to
the Customer without undue delay. KARL MAYER STOLL may
demand appropriate remuneration for the support of the­Customer in the case of enquiries from data subjects.
Insofar as this is possible within the scope of the functionalitiesof the Solutions and the Platform, the Customer itself shallcorrect, erase or restrict Personal Customer Data to the­extent that this is required under data protection laws applicable to the Customer.

5.	Quality assurance and other obligations of KARL MAYER
STOLL
Furthermore, KARL MAYER STOLL has the following obligations:
5.1 KARL MAYER STOLL and anyone subordinate to them who
has legitimate access to Personal Customer Data shall process those data exclusively in accordance with the provisionsof the Main Contract, this Commissioned Data Processing,and the instructions of the Customer in order to provide theSolutions and the Platform in accordance with the Agreement, unless they are legally obliged to process it differently.
5.2 To maintain confidentiality in accordance with Art. 28(3)(2)(b),29, and 32(4) GDPR, KARL MAYER STOLL uses only employees
in the performance of its activities who have been obligated toconfidentiality and have been familiarised with the data
­protection provisions relevant to them. KARL MAYER STOLL
employees are informed that the confidentiality obligation
pursuant to this Section 5.2 shall survive the termination of
their employment. A statutory duty of disclosure remains
unaffected.
5.3 KARL MAYER STOLL supports the Customer, taking into
­account the nature of the Data Processing, to the necessary
and appropriate extent in ensuring compliance with theCustomer’s legal obligations.
5.4 KARL MAYER STOLL’s data protection officer can be reachedat the following contact details: Karl Mayer Verwaltungs­
gesellschaft mbH, Olaf Nothdurft (Data Protection Officer),

5.5

5.6

5.7

5.8

5.9

6.	
6.1

6.2
6.3

page 14 / 21I­ndustriestr. 1, D-63179 Obertshausen,
mailto:dataprotection@karlmayer.com
KARL MAYER STOLL shall inform the Customer without undue delay about measures and inspections by a supervisory
authority regarding the Data Processing. The same applies inthe event of investigations by a competent supervisory­authority in the context of administrative offence or criminal
proceedings.
To the extent that the Customer is exposed to (a) the control
of a supervisory authority, (b) an administrative offence or
criminal proceedings, (c) the liability claim of a data subject
or a third party or (d) another claim or a request for information in connection with this Commissioned Data Processing,
KARL MAYER STOLL shall support the Customer to the necessary and reasonable extent.
KARL MAYER STOLL regularly monitors its internal processes as well as the technical and organisational measures ­(cf. Annex 1) to ensure that the Data Processing in its area of
responsibility is carried out in accordance with the requirements of the GDPR.
KARL MAYER STOLL supports the Customer in its area of­responsibility and, as far as possible, within the scope of existing duties to provide information to supervisory authorities
and data subjects to the necessary and appropriate extent
and provides the Customer with all relevant information inthis context.
KARL MAYER STOLL shall provide the Customer in its areaof responsibility with all information necessary to prove­compliance with the GDPR and enable and support controls
regarding the Data Processing within the scope of this Commissioned Data Processing (cf. Section 7).
Sub-processing relationships
For the purposes of this Section 6, subcontracting relationships shall be understood to mean those services which­relate directly to the provision of the Solutions and the Platform. This does not include any ancillary services that KARL
MAYER STOLL makes use of (such as telecommunications,transport, or cleaning or security services). However, KARL
MAYER STOLL shall make appropriate and legally compliant
contractual agreements and take control measures to­guarantee the data protection and the data security of the
Personal Customer Data, including in the case of outsourced
ancillary services.
The sub-processors approved by the Customer when theagreement was entered into are listed in Annex 2.
A further commissioning of sub-processors or the replacement of existing sub-processors in accordance with Annex 2
is permissible under the following conditions:(a) KARL MAYER STOLL notifies the Customer of the involvement of the sub-processor in advance in writing or text form
within a reasonable period of time, which must be at least
fourteen (14) days, and the Customer does not object to thiswithin a reasonable period, whereby the Customer may object
only for good cause. Insofar as the Customer objects for goodcause and the Parties cannot reach an amicable solution regarding the sub-processor in question, the Customer shall be
granted a special right of termination.
(b) KARL MAYER STOLL enters into agreements with the
sub-processors in accordance with Art. 28 GDPR, which contain data protection provisions that are comparable in principle to the Commissioned Data Processing applicable between
the Parties. In particular, KARL MAYER STOLL shall ensure

6.4
6.5

7.	
7.1

7.2

7.3

8.	
8.1

that sufficient guarantees exist for implementing technicaland organisational measures. The sub-processor further
grants the Customer audit and control rights essentially­comparable to Section 7, including the right of the Customer,
on written request, to receive information from KARL MAYER
STOLL on the content and implementation of relevant dataprotection obligations within the scope of the sub-processing
relationship (if applicable, by inspecting the related documentation).
If the sub-processor provides the agreed service outside theEU or the EEA, Section 2.5 shall apply accordingly.
KARL MAYER STOLL remains responsible to the Customer
for the fulfilment of the obligations of the commissioned
sub-processor.
Control rights of the Customer
The Customer may verify compliance with (a) the obligations
under the GDPR as well as (b) this Commissioned Data
­Processing, particularly regarding the technical and organi­sational measures. The Parties have the common understanding that checks of the Customer and the provision of­information and evidence by KARL MAYER STOLL for compliance with the obligations under the GDPR and this Commissioned Data Processing will primarily be carried out in such a
way that KARL MAYER STOLL provides the Customer withcurrent test certificates, reports or report extracts from independent third parties (such as auditors, auditing departments,
data protection officers, IT security department, data protection auditors or quality auditors) or suitable certifications by
IT security or data protection auditing. This will not affect theCustomer’s rights under Sections 7.2 or 7.3.
To the extent necessary in individual cases, during the term of
this Commissioned Data Processing and after consultation
with KARL MAYER STOLL, the Customer may perform or
have others perform appropriate inspections of the relevant
KARL MAYER STOLL business premises in which the Data
Processing occurs, either itself or through suitable inspectors
to be named in individual cases who are obliged to maintainconfidentiality. The inspections are limited to the Data Processing of Personal Customer Data and must be performed
without avoidable disturbances at KARL MAYER STOLL’s
premises. KARL MAYER STOLL may object to the selection of
the inspector for good cause (such as lack of reliability or acompetitive relationship with KARL MAYER STOLL or the
KARL MAYER Group). Except in the case of urgent, objectively
justified reasons, which are to be documented accordingly by
the Customer, inspections will be carried out at the businesspremises of KARL MAYER STOLL after reasonable advancenotice of at least one (1) month, during the normal businesshours of KARL MAYER STOLL, and at most every twelve (12)months. KARL MAYER STOLL may demand proper remuneration for assistance in carrying out an inspection. The expenditure of an inspection is generally limited to one (1) day per
calendar year for KARL MAYER STOLL.
KARL MAYER STOLL shall provide the Customer with the relevant and necessary information upon request and make therelevant evidence available.

8.2

KARL MAYER STOLL shall notify the Customer immediately if(a) a security breach results in the accidental or unlawful­destruction, loss, alteration or unauthorised disclosure of oraccess to Personal Customer Data or (b) KARL MAYER
STOLL, its employees or agents have breached any data
­protection regulations or the obligations set out herein which
relate to Personal Customer Data.
KARL MAYER STOLL shall document the relevant informationand make it available to the Customer for further measures.

9.	
9.1

Authority of the Customer to issue instructions
Data Processing shall be governed exclusively by (a) thisCommissioned Data Processing, (b) possible instructions
within the functionalities of the Solutions and the Platform(such as login, change of user name, change of password andlogout, etc.) and support requests of the Customer as well as(c) any other instructions of the Customer, each of which shallbe documented in writing or in text form.
The Customer shall immediately confirm verbal instructionsin writing or text form.
KARL MAYER STOLL shall inform the Customer immediately
if it believes an instruction violates the GDPR. KARL MAYER
STOLL is entitled to suspend the execution of the relevant­instruction until it is confirmed or amended by the Customer.

9.2
9.3

10.	Erasure of Personal Customer Data and return of datacarriers
10.1 Copies or duplicates of Personal Customer Data must not bemade without the Customer’s knowledge. This does not apply
to backup copies, insofar as they are necessary to ensure
proper Data Processing, as well as data that are required tobe compliant with statutory retention obligations.
10.2 After completion of the contractually agreed activities, or­earlier on the Customer’s request – but at the latest on termination of the Main Contract – KARL MAYER STOLL shall­return to the Customer all documents, created processing
and utilisation results, and data files that are connected withthis Commissioned Data Processing, or destroy them in­accordance with data protection law after obtaining consent.
The same applies to test and waste material. The record of
the erasure shall be submitted to the Customer upon request.
Appendix 2 Annex 1
Technical and organisational measures
A. General
1.	
1.1

Reports of infringements on the part of KARL MAYER STOLLKARL MAYER STOLL designs the data processing, its operational procedures and the associated processes, systems andinstallations in such a way that it can record, recognise andreport any Data Protection infringements.
page 15 / 21

Confidentiality (Art. 32(1)(b) GDPR)
Physical access control
Measures that prevent unauthorised persons from accessing
Data Processing systems with which Personal Data are­processed or used:• The access protection (building) to the Contractor’s systems is secured by a locking system (key in connection withtransponder). A distinction is made between outdoor areas(buildings) and indoor areas. The individual zones are subject to different security requirements.
• Access by visitors is organisationally regulated in detail
within the framework of the access concept. Visitors mustring the bell at the main entrance, sign in, and picked up
where applicable.
• Before entering the floor, the visitor must ring the bell again
and register once more.

1.2

1.3

1.4

2.	
2.1

2.2
2.3

• Visitors are accompanied by employees of the Contractor
for the duration of their visit.
• Emergency exits are only accessible from the inside.
• The issue of keys and the allocation of access authorisations
are regulated in an organisational guideline.
• The HR department of the Contractor is centrally responsible
for the administration of the keys.
System access control
Measures that prevent Data Processing systems from being
used by unauthorised persons:• User accounts are checked regularly, i.e. at least annually.
• User accounts are blocked promptly as part of the offboarding process.
• User accounts are password protected. All passwords must
be created and updated in accordance with the “KARL
MAYER Group IT User Policy”. This policy addresses aspects of complexity, handling, custody and record keeping.
• It is ensured that each employee of the Contractor has only
the rights they need for their activity (need to know principle).
• The principle of the tidy workplace applies.
Memory access control
Measures which ensure that those authorised to use a Data
Processing system can only access the data for which they
have access authorisation and that Personal Data cannot be
read, copied, modified or removed without authorisation­during processing and use and after storage:
Access management for operating system and databasemanagement:• Access is regulated organisationally.
• Access to the operating system and applications is logged
on a personal basis.
• Access authorisations are only granted after approval by
the person responsible for information.
• A check is made before the permissions are assigned.
System measures• The Contractor uses up-to-date antivirus solutions and­carries out centralised and automatic pattern and software
updates.
• Firewall systems are used as central security components
in various places at the Contractor’s place of business.
• Changes to the Client’s data shall be recorded.
• Remote access is via VPN and is encrypted and protected
via a second factor.
• Encrypted hard disks on local terminals.
• Software and security updates are carried out promptly as
part of the data centre maintenance.
• Access authorisations are only granted after written­approval by the supervisor.
• A check is made before permissions are given.
• Fire alarm system and UPS in the data centre and at­central infrastructure nodes.
Integrity (Art. 32(1)(b) GDPR)
Transfer control
The Contractor has implemented the requirements as follows:• VPN connections with second factor.
• Special protection during physical transport of data storage
devices.
Input control• Traceability through personal log-in and activity logging
Separation control• The Contractor shall ensure that data collected for different
purposes can be processed separately.

2.4

3.	
3.1

3.2

• Separation of data by network separation (VLAN).
• Personal Data of the respective Clients are logically separated from each other by assignment to the respective user
accounts.
Order control• Documentation of processing activities.
• Careful selection of sub-processors.
• No use of sub-processors who have not been obligated inaccordance with Art. 28 GDPR.
• Written agreement with the sub-processor on the minimum
data protection standard.
• Adequate monitoring of sub-processors.
• Ensuring the destruction or return of the data after completion of the order in compliance with data protection regulations.
Availability and resilience (Art. 32(1)(b) GDPR)
Availability Control• Patch management for servers and End Devices.
• Uninterruptible power supply (UPS)• Fire alarm system.
• Virus protection.
• Firewall.
• Backup and restore strategy.
Timely manner restorability (Art. 32(1)(c) GDPR)• Service agreements with contracted service providers.

4.	Procedures for periodic test, assessment and evaluation(Art. 32(1)(d), Art. 25(1) GDPR)• Data protection management system• Incident response management.
• Data protection by default (Art. 25(2) GDPR).
• Regular documented mandatory training for all employees.
Additional, annual classroom training for staff in particularly
sensitive areas.
• Documented employee commitment to data protection.
• Instruction on postal and telecommunications secrecy forthe relevant group of employees.
• Nondisclosure agreements (NDA) with partners and service
providers.
• Appointment of a data protection officer and additional dataprotection coordinators at local sites.
B.  Cloud services / data centres in which the Solutions and the
Platform are hosted (currently AWS Cloud service)
1.	

1.1

page 16 / 21

Information Security Programme
Amazon Web Services Inc. (“AWS”) maintains an information
security programme (including the establishment and enforcement of internal policies and procedures) designed to (a)help the Customer protect Personal Customer Data from­accidental or unlawful loss, access or disclosure, (b) identify
reasonably foreseeable and internal risks to security and­unauthorised access to the AWS Network, and (c) mitigate­security risks, including through risk assessment and periodic
testing. AWS will designate one or more employees to coordinate and be responsible for the information security programme. The information security programme will include
the following measures:
Network security
The AWS network is electronically accessible to employees,
contractors and all other persons necessary for the provisionof the AWS services. AWS maintains access controls and poli-

1.2

2.	

cies to govern what access to the AWS network is permitted
from each network connection and user, including the use of
firewalls or functionally equivalent technologies and authentication controls. AWS maintains remediation and incident­response plans to address potential security threats.
Physical security(a)	Physical access controls
The physical components of the AWS network are housed
in inconspicuous facilities (“Facilities”). Physical access
controls are used to prevent unauthorised access to Facilities at both perimeter and building entrances. Passage
through the physical barriers in the Facilities requires­either electronic access control (such as card access­systems, etc.) or validation by human security personnel(such as contracted or internal security guards, reception
staff, etc.). Photo IDs shall be assigned to employees andcontractors and shall be kept while employees and contractors are in the Facilities. Visitors must register withthe relevant staff, identify themselves, receive a visitor’s
badge to wear while in the Facilities, and be accompanied
by authorised staff or contractors at all times when visiting the Facilities.
(b)	Limited access for employees and contractors
AWS grants access to the Facilities to those employees
and contractors who have a legitimate business need forsuch access rights. If an employee or contractor no longer
needs the access rights assigned to him or her, the accessrights will be revoked immediately, even if the employee
or contractor continues to be an employee of AWS or its
affiliates.
(c) Physical safeguards
	All access points (with the exception of the main entrance
doors) are kept in a secured (locked) state. Access points
to the Facilities are monitored by CCTV cameras that­record all persons entering the Facilities. AWS also maintains electronic intrusion detection systems designed
to detect unauthorised access to the Facilities, including
monitoring of weak points (such as main entrance doors,emergency exit doors, roof hatches, loading dock doors,etc.) with door contacts, glass break devices, interior­motion detectors or other devices designed to detect­individuals attempting to gain access to the Facilities. All
physical access to the Facilities by staff and contractors islogged and regularly checked.
Ongoing assessment
AWS conducts regular reviews of the security of its AWS­network and the adequacy of its information security programme, as measured against industry security standards
and its policies and procedures. AWS shall continuously­assess the security of its AWS network and related AWS­services to determine whether additional or different security
measures are needed to respond to new security risks or­findings from periodic reviews .

page 17 / 21

Appendix 2 Annex 2
Authorised sub-processors
Sub-processors

Services

Seat and adequate level of dataprotection

KARL MAYER STOLL R&D GmbH,
Industriestr. 1, D-63179 Obertshausen

Software development in relation to the
Platform and the Solutions

Germany (EU)KM.ON GmbH,
Carl-Benz-Str. 21, D-60386 Frankfurt/Main

Provision, operation, support and maintenance of the Solutions and the Platform

Germany (EU)KARL MAYER STOLL Textilmaschinenfabrik GmbH,
Industriestraße 1, 63179 Obertshausen

Support activities related to Networked
Machines

Germany (EU)KM.ON Asia Ltd,
2907 Metroplaza Tower 2, 223 Hing Fung Road,
Kwai Chung, New Territories, Hong Kong

Provision, operation, support and maintenance of the Solutions and the Platform

Hong Kong
EU standard contractual clauses

KARL MAYER (HK) Ltd,
2907 Metroplaza Tower 2, 223 Hing Fung Road ,Kwai Chung, New Territories, Hong Kong

Support activities related to Networked
Machines

Hong Kong
EU standard contractual clauses

KARL MAYER (China) Ltd.,
No. 518 Changwu South Road, Wujin District,
Changzhou City 213167, China

Support activities related to Networked
Machines

China
EU standard contractual clauses

Amazon Web Services Inc.,
Hosting of the Solutions and the Platform
410 Terry Ave. North, Seattle, WA 98109-5210, USAUSA
EU standard contractual clauses
Data centre Frankfurt/Main region

Auth0 Inc.,
10800 NE 8th St., Suite 700, Bellevue, WA 98004,
USA

Providing services for the authenticationof users of the Solutions and the PlatformUSA
EU standard contractual clauses

Mayer Textile Machine Corp.,
310 North Chimney Rock Road, 27409 Greensboro,
North Carolina, USA

Support activities related to Networked
MachinesUSA
EU standard contractual clauses

KARL MAYER STOLL INDIA PRIVATE LIMITED
103, Dimple Arcade, Asha Nagar, Kandivali
East400101 Mumbai, Maharashtra

Support activities related to Networked
MachinesIndia
EU standard contractual clauses

KARL MAYER STOLL Bangladesh Limited
House – G10A (NE), Road- 79 Gulshan – 02
Dhaka – 1212, Bangladesh

Support activities related to Networked
Machines

Bangladesh
EU standard contractual clauses

Appendix 3:
Terms and conditions in relation to the Act on the Protectionof Personal Information and other data laws and regulations
related to data protection in Japan
1.	
1.1

1.2

Definitions, starting point and ranking
The definitions in the Connectivity Terms and Conditions shallapply mutatis mutandis to this Appendix 3, subject to the following variation: The Customer is also referred to as the­“Client” and KARL MAYER STOLL is also referred to as the“Contractor”. In this Appendix 3, KARL MAYER STOLL refers
to NIPPON MAYER LTD., 27-33 Kamikitano 1-Chome, 9188522 Fukui-City, Japan, or an affiliate or any other entity of
the KARL MAYER Group, as the case may be. The Connectivity
Terms and Conditions are referred to as the “Main Contract”.
Without prejudice to provisions in the Main Contract and Appendix 2, the provision of services in the form of the provision,
operation, support and maintenance of the Solutions and the
Platform in accordance with the provisions of the Main­Contract requires the processing of the Customer’s personal
information in the sense of Article 2, Section 1 of the Act on

1.3

page 18 / 21

the Protection of Personal Information (“Japanese Personal
Customer Information”, and the Act is hereinafter referred toas the “APPI”). This Appendix 3 (“Outsourced Data Processing”) sets out, as an agreement on outsourced processing
pursuant to Article 25 of the APPI between the Parties, thedata protection obligations of the Customer and KARL­MAYER STOLL resulting from the processing of Japanese
Personal Customer Information in the context of the contractual provision and use of the Solutions and the Platform(“Japanese Data Processing”). The Customer is solely responsible for the lawfulness of the disclosure of Japanese Personal Customer Information to KARL MAYER STOLL as well as
the lawfulness of the Japanese Data Processing.
If there is any inconsistency or ambiguity between a provisioncontained in the main body of this Outsourced Data Processing and a provision contained in its appendices, the provisioncontained in the main body shall prevail. If there are contradictions or ambiguities between provisions of this Outsourced
Data Processing and provisions of the Main Contract, the provisions of this Outsourced Data Processing shall take precedence as far as data protection matters are concerned.

2.	Object, duration, and specification of the Japanese Data
Processing
2.1 The object of the Japanese Data Processing is the provision,
operation, support and maintenance of the Solutions and the
myKM.ON Platform by KARL MAYER STOLL for the Customer
and its users in accordance with the provisions of the Main
Contract. The details are specified in the Main Contract.
2.2 The term of this Outsourced Data Processing corresponds tothe term of the Main Contract. This Outsourced Data Processing ends with the termination of the Main Contract.
2.3 The scope, type, and purpose of the Japanese Data Processing is the provision, operation, support and maintenance of
the Solutions and the myKM.ON Platform in accordance withthe provisions of the Main Contract by KARL MAYER STOLL
as well as the enabling of the contractual use of the Solutions
and the Platform by the Customer and its users. The details
are specified in the Main Contract.
2.4 The types of Japanese Personal Customer Information andthe categories of data subjects are as follows:(a) Types of Japanese Personal Customer Information are (a)the user’s name and email address, (b) the user’s role with theCustomer, (c) the user’s IP address, and (d) an authentication
token (~ individual characteristic that identifies the user for authentication purposes within the Solutions and the Platform).
(b) Categories of data subjects are employees and workersof the Customer.
2.5 The Solutions and Platform is a global software solution.
Against this background, Japanese Data Processing occurs
both (a) within Japan and (b) outside Japan. Japanese Data
Processing outside Japan takes place only if the special protection provisions of Article 28, Section 1 of APPI are fulfilled
in order to ensure data protection which satisfies equivalent
standards to that in Japan. KARL MAYER STOLL sees an­appropriate “equivalent standards” on the basis of rules of the
Personal Information Protection Commission of Japan (Public
Notice No. 1 of 2019 of the Commission).
The Customer authorises a data transfer to countries outside
Japan to the sub-processors/recipients. KARL MAYER STOLL
shall ensure that sub-processors/recipients will comply withrequirements under APPI. In this regard, it is deemed that, aslong as KARL MAYER STOLL and the sub-processors/recipients complies with requirements under the GDPR by complying with Appendix 2, the sub-processors/recipients comply
with requirements under APPI in relation to the data transfer
to and the Japanese Data Processing by the sub-processors/
recipients unless the Customer reasonably requests KARL
MAYER STOLL in writing to act differently or unless the Personal Information Protection Commission or any other publicauthority in Japan indicates differently.
3.	
3.1

3.2

3.3

Technical, organisational and other measures
KARL MAYER STOLL takes all necessary technical, organisational and other measures in its area of responsibility in­accordance with Article 23 of APPI on the protection of­Japanese Personal Customer Information.
Insofar as a review or inspection of the Customer reveals aneed to adapt the technical, organisational or other measures,
the Parties shall implement this by mutual agreement.
The technical, organisational or other measures to be taken
by KARL MAYER STOLL are subject to technical progress andfurther development. KARL MAYER STOLL may implement
alternative adequate measures. The Customer must be­informed in writing or text form of any significant changes.

4.	
4.1

4.2

Rights of data subjects
KARL MAYER STOLL supports the Customer within its areaof responsibility and as far as possible by means of suitable
technical, organisational and other measures in answeringand implementing requests from data subjects under APPI.
KARL MAYER STOLL may not disclose, port, rectify, erase or
restrict the processing of Japanese Personal Customer­Information on its own authority, but only after receiving­documented instructions from the Customer. If a data subject
contacts KARL MAYER STOLL directly, KARL MAYER STOLL
shall, while responding the data subject pursuant to APPI,
forward that request to the Customer without undue delay.
KARL MAYER STOLL may demand appropriate remuneration
for the support of the Customer in the case of enquiries fromdata subjects.
Insofar as this is possible within the scope of the functionalitiesof the Solutions and the myKM.ON Platform, the Customer­itself shall correct, erase or restrict Japanese Personal­Customer Information.

5.	Quality assurance and other obligations of KARL MAYER
STOLL
Furthermore, KARL MAYER STOLL has the following obligations:
5.1 KARL MAYER STOLL and anyone subordinate to them who
has legitimate access to Japanese Personal Customer Information shall process those data exclusively in accordancewith the provisions of the Main Contract, this Outsourced
Data Processing, and the instructions of the Customer in order to provide the Solutions and the Platform in accordancewith the Agreement, unless they are legally obliged to process it differently.
5.2 To maintain confidentiality, KARL MAYER STOLL uses only
employees in the performance of its activities who have been
obligated to confidentiality and have been familiarised withthe data protection provisions relevant to them (including
without limitation provisions under APPI). KARL MAYER
STOLL employees are informed that the confidentiality­obligation pursuant to this Section 5.2 shall survive the termination of their employment. A statutory duty of disclosure­remains unaffected by this.
5.3 KARL MAYER STOLL supports the Customer, taking into
­account the nature of the Japanese Data Processing, to thenecessary and appropriate extent in ensuring compliancewith the legal obligations, in particular in carrying out dataprotection impact assessments and in any necessary priorconsultations with the competent supervisory authorities.
5.4 KARL MAYER STOLL’s data protection officer can be reachedat the following contact details: NIPPON MAYER LTD.,
27-33 Kamikitano 1-Chome, 918-8522 Fukui-City, Japan.
­Responsible person at Nippon Mayer is Mr. Igarashi,(Tomokasu.Igarashi@karlmayer.com), who is taking care of
all IT topics at NM.
5.5 KARL MAYER STOLL shall inform the Customer without undue delay about measures and inspections by a supervisory
authority regarding the Japanese Data Processing. The same
applies in the event of investigations by a competent supervisory authority in the context of administrative offence or
criminal proceedings.
5.6 To the extent the Customer is exposed to (a) the control of asupervisory authority, (b) an administrative offence or criminal proceedings, (c) the liability claim of a data subject or athird party or (d) another claim or a request for information inpage 19 / 21

5.7

5.8

5.9

6.	
6.1

6.2

6.3

(a)

(b)

connection with this Outsourced Data Processing, KARL
MAYER STOLL shall support the Customer to the necessary
and reasonable extent.
KARL MAYER STOLL regularly monitors its internal processes
as well as the technical, organisational and other measures
to ensure that the Japanese Data Processing in its area of­responsibility is carried out in accordance with the requirements of the applicable data protection law and that the­protection of the rights of the data subjects is guaranteed.
KARL MAYER STOLL supports the Customer in its area of­responsibility and, as far as possible, within the scope of existing duties to provide information to supervisory authorities
and data subjects to the necessary and appropriate extent
and provides the Customer with all relevant information inthis context.
KARL MAYER STOLL shall provide the Customer in its area of
responsibility with all information necessary to prove compliance with the applicable data protection laws and enable andsupport controls regarding the Japanese Data Processing
within the scope of this Outsourced Data Processing (cf.
­Section 7).
Sub-processing relationships
For the purposes of this Section 6, subcontracting relationships shall be understood to mean those services which­relate directly to the provision of the Solutions and the Platform. This does not include any ancillary services that KARL
MAYER STOLL makes use of (such as telecommunications,transport, or cleaning or security services). However, KARL
MAYER STOLL shall make appropriate and legally compliant
contractual agreements and take control measures to guarantee the data protection and the data security of the Japanese Personal Customer Information, including in the case ofoutsourced ancillary services.
The sub-processors shall be approved, in advance, by the
Customer when the agreement was entered into. The
sub-processors which are listed in Appendix 2, Annex 2 aredeemed to be approved in advance for the purpose of thisSection 6.2 as well.
A further commissioning of sub-processors or the replacement of existing sub-processors is permissible under the­following conditions:
KARL MAYER STOLL notifies the Customer of the involvement of the sub-processor in advance in writing or text form
within a reasonable period of time, which must be at least
fourteen (14) days, and the Customer does not object to thiswithin a reasonable period, whereby the Customer may object
only for good cause. Insofar as the Customer objects for goodcause and the Parties cannot reach an amicable solution­regarding the sub-processor in question, the Customer shallbe granted a special right of termination.
KARL MAYER STOLL enters into agreements with the
sub-processors in such a way that KARL MAYER STOLL complies with Article 25 of APPI, which contain data protection
provisions which requires necessary and appropriate action
to supervise the sub-processors that are comparable in principle to the Outsourced Data Processing applicable between
the Parties. In particular, KARL MAYER STOLL shall ensurethat sufficient guarantees exist for implementing technical,
organisational and other measures. The sub-processor further grants the Customer audit and control rights essentiallycomparable to Section 7, including the right of the Customer,
on written request, to receive information from KARL MAYER

6.4
6.5

7.	
7.1

7.2

7.3

STOLL on the content and implementation of relevant dataprotection obligations within the scope of the sub-processing
relationship (if applicable, by inspecting the related documentation).
If the sub-processor provides the agreed service outside­Japan, Section 2.5 shall apply accordingly.
KARL MAYER STOLL remains responsible to the Customer
for the fulfilment of the obligations of the commissioned
sub-processor.
Control rights of the Customer
The Customer may verify compliance with (a) the applicabledata protection obligations as well as (b) this Outsourced
Data Processing, particularly regarding the technical, organisational and other measures. The Parties have the common
understanding that checks of the Customer and the provisionof information and evidence by KARL MAYER STOLL for compliance with the applicable data protection obligations andthis Outsourced Data Processing will primarily be carried out
in such a way that KARL MAYER STOLL provides the Customer with current test certificates, reports or report extracts
from independent third parties (such as auditors, auditing­departments, data protection officers, IT security department,
data protection auditors or quality auditors) or suitable certifications by IT security or data protection auditing. This will notaffect the Customer’s rights under Sections 7.2 or 7.3.
To the extent necessary in individual cases, during the term of
this Outsourced Data Processing and after consultation with
KARL MAYER STOLL, the Customer may perform or haveothers perform appropriate inspections of the relevant KARL
MAYER STOLL business premises in which the Japanese
Data Processing occurs, either itself or through suitable­inspectors to be named in individual cases who are obliged tomaintain confidentiality. The inspections are limited to theJapanese Data Processing of Japanese Personal Customer
Information and must be performed without avoidable disturbances at KARL MAYER STOLL’s premises. KARL MAYER
STOLL may object to the selection of the inspector for goodcause (such as lack of reliability or a competitive relationshipwith KARL MAYER STOLL or the KARL MAYER Group). Except
in the case of urgent, objectively justified reasons, which are
to be documented accordingly by the Customer, inspections
will be carried out at the business premises of KARL MAYER
STOLL after reasonable advance notice of at least one (1)month, during the normal business hours of KARL MAYER
STOLL, and at most every twelve (12) months. KARL MAYER
STOLL may demand proper remuneration for assistance incarrying out an inspection. The expenditure of an inspection is
generally limited to one (1) day per calendar year for KARL
MAYER STOLL.
KARL MAYER STOLL shall provide the Customer with the­relevant and necessary information upon request and makethe relevant evidence available.

8.	Reports of infringements on the part of KARL MAYER
STOLL
8.1 KARL MAYER STOLL designs the data processing, its operational procedures and the associated processes, systems andinstallations in such a way that it can record, recognise andreport any Data Protection infringements.
8.2 KARL MAYER STOLL shall notify the Customer immediately
if (a) a security breach results in the accidental or unlawfuldestruction, loss, alteration or unauthorised disclosure of or

page 20 / 21

access to Japanese Personal Customer Information or (b)KARL MAYER STOLL, its employees or agents have breached
any data protection regulations or the obligations set out
herein which relate to Japanese Personal Customer Information.
KARL MAYER STOLL shall make its notification in such a way that
the Customer can fulfil its legal obligations, in particular pursuant to Article 26 of APPI. Also, KARL MAYER STOLL shallmake its notification to the Personal Information Protection
Commission and a relevant data subject as required by that
Article. KARL MAYER STOLL shall document the relevant­information and make it available to the Customer for further
measures.
9.	
9.1

9.2
9.3

Authority of the Customer to issue instructions
Japanese Data Processing shall be governed exclusively by(a) this Outsourced Data Processing, (b) possible instructions
within the functionalities of the Solutions and the Platform(such as login, change of user name, change of password andlogout, etc.) and support requests of the Customer as well as(c) any other instructions of the Customer, each of which shallbe documented in writing or in text form.
The Customer shall immediately confirm verbal instructionsin writing or text form.
KARL MAYER STOLL shall inform the Customer immediately
if it believes an instruction violates applicable data protection
law. KARL MAYER STOLL is entitled to suspend the executionof the relevant instruction until it is confirmed or amended by
the Customer.

10.	 Erasure of Japanese Personal Customer Information andreturn of data carriers
10.1 Copies or duplicates of Japanese Personal Customer Information must not be made without the Customer’s knowledge.
This does not apply to backup copies, insofar as they are necessary to ensure proper Japanese Data Processing, as well
as data that are required to be compliant with statutory­retention obligations.
10.2 After completion of the contractually agreed activities, or earlier on the Customer’s request – but at the latest on termination of the Main Contract – KARL MAYER STOLL shall returnto the Customer all documents, created processing and utilisation results, and data files that are connected with this Outsourced Data Processing, or destroy them in accordance withdata protection law after obtaining consent. The same applies
to test and waste material. The record of the erasure shall be
submitted to the Customer upon request.
11.	 Other Provisions
11.1 If APPI and/or any legislation and/or regulation related todata protection is amended, replaced, enacted, re-enacted orconsolidated, KARL MAYER STOLL may adjust this Appendix
3 so that it will be compliant with the amended, replaced,­enacted, re-enacted or consolidated legislation or regulation.
KARL MAYER STOLL shall notify the Customer of this, andunless the Customer notifies KARL MAYER STOLL of its objection withing fourteen (14) calendar days with good cause,
this adjustment shall constitute the terms and conditions
binding both Parties.

NIPPON MAYER LTD. . 27-33 Kamikitano 1-Chome . 918-8522 Fukui-City . Japan . www.karlmayer.com
page 21 / 21