KARL MAYER (China) Ltd.

CONNECTIVITYTERMS AND CONDITIONS
1st May 2022

Scope and version
The following terms and conditions including their appendices andannexes (“Agreement”) of KARL MAYER (China) Ltd. (hereinafterreferred to as “KARL MAYER CHINA”) regulate rights and obligations in connection with textile machines (“Machines”), which (i)KARL MAYER CHINA has provided to the “Customer” for use andwhich (ii) by means of a gateway (“k. ey device”) can communicate
with the Customer and with companies of the KARL MAYER groupof companies via the Internet. The Customer and KARL MAYER

CHINA are hereinafter individually also referred to as “Party” andjointly also as “Parties”. If other contractual agreements alreadyexist between KARL MAYER CHINA and the Customer, the content
of which is (partly) similar to this Agreement, these agreements
shall be replaced by this Agreement. Earlier versions of thisAgreement existing between the Parties are superseded by thisAgreement.

page 1 / 18

Table of Contents
List of definitions. .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 3Preamble .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 3A.	 General regulations; Solutions; Use of the Platform .  .  .  .  .  .  .  . 31. Solutions; Plattform. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Confidentiality. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Rights to data; Processing of data; Protection of secrets . . . . . . . 4
4.	Information on Solutions and k.ey devices; Quality
specifications; Product information and labelling. . . . . . . . . . . . . . 4
5. Liability; Limitation of liability. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
6. Service provision by the KARL MAYER Group; Transfer . . . . . . . . 5
7.	Applicable law; Arbitration clause; Severability clause;
Singular and plural formulations; Contract amendments andwritten form. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
B.	 Provision and maintenance of the k.ey device.  .  .  .  .  .  .  .  .  .  .  .  .  . 58. Subject of the Agreement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
9.	Hardware-related obligations and rights of KARL MAYER
CHINA within the scope of the transfer of the k.ey device . . . . . . 5
10.	Software-related obligations and rights of KARL MAYER
CHINA within the scope of the transfer of the k.ey device . . . . . . 6
11.	Obligations of the Customer within the scope of the provisionand maintenance of the k.ey device. . . . . . . . . . . . . . . . . . . . . . . . . . . 6
12.	No warranty extension through surrender of the k.ey device;
Liability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
C.	 Connectivity Packages .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 613. Object of the Connectivity Packages. . . . . . . . . . . . . . . . . . . . . . . . . . 6
14. Customer obligations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
15. Obligations of KARL MAYER CHINA. . . . . . . . . . . . . . . . . . . . . . . . . . 6
16. Default in payment; Setoff. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
17.	Delivery time; Force majeure; Reservation of self-delivery;
Early or partial deliveries; Amendments. . . . . . . . . . . . . . . . . . . . . . 7
18.	Notice of defects; Claims for defects; No right of withdrawal;
Use of the Remote Service Connection . . . . . . . . . . . . . . . . . . . . . . . 7
List of Appendices and Annexes . .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 7Appendix 1: Content and scope of the Connectivity Packages .  .  . 819. SaaS Solution Dashboard Lite. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
20. Remote Service Connection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
21. Remote Set-Up and Installation Support for Connectivity . . . . . . 8
Annex A: Product data sheet; k.management; Dashboard Lite. . . . . . 9
1. Dashboard Lite – Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2. Specification and description of the Dashboard Lite. . . . . . . . . . . . 9

Annex B: Hardware requirements, network requirements, andnecessary system environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1. k.ey device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2. Customer terminal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.	Hardware requirements and network requirements related
to the Machine and Connectivity Packages, as well as thenecessary system environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Annex C: Service Level Agreement – Dashboard Lite and Remote
Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.	Scope of this Service Level Agreement – Dashboard Lite;
Relationship to the Agreement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2. Definitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3. Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4. Remote Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
5. Incident Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
6. Maintenance Work. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Appendix 2: Data Processing Agreement for the Connectivity
Terms and Conditions .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 13
1. Definitions, starting point and ranking . . . . . . . . . . . . . . . . . . . . . . . 13
2. Object, duration, and specification of the Data Processing. . . . . 13
3. Technical and organisational measures. . . . . . . . . . . . . . . . . . . . . . 13
4. Rights of data subjects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
5.	Quality assurance and other obligations of KARL MAYER
CHINA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
6. Sub-processing relationships. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
7. Control rights of the Customer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
8.	Reports of infringements on the part of KARL MAYER CHINA. 15
9. Authority of the Customer to issue instructions . . . . . . . . . . . . . . 15
10. Erasure of data and return of data carriers. . . . . . . . . . . . . . . . . . . 15
Appendix 2 Annex 1: Technical and organisational measures. . 15
A. General .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 15
1. Confidentiality. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2. Integrity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3. Availability and resilience. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
4. Procedures for periodic test, assessment and evaluation. . . . . . 16
B.	Cloud services / data centres in which the Solutions andthe Platform are hosted (currently AWS Cloud service).  .  .  . 16
1. Information Security Programme. . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2. Ongoing assessment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Appendix 2 Annex 2: Authorised sub-processors.  .  .  .  .  .  .  .  .  .  .  .  . 18

page 2 / 18

List of definitions
For the purposes of this Agreement, the following definitions shallapply:“Accounting Year”

As defined in Appendix 1 Annex A.

“Connectivity Packages”

As defined in the preamble (B).

“Dashboard”

As defined in Appendix 1 Annex A.

“Dashboard Lite”

As defined in Appendix 1 Annex A.

“Data Processing”

As defined in Appendix 2.

“Defective Provision”

As defined in paragraph 7.5.

“Confidential Information”

As defined in paragraph 2.1.

“KARL MAYER Group”

All companies which control or are affiliated with
KARL MAYER CHINA and, in addition, any other person,company, joint venture or other legal entity that is
directly or indirectly controlled, through one or moreintermediaries, by KARL MAYER Holding GmbH & Co. KG,
Industriestr. 1, 63179 Obertshausen, Germany.
For the purposes of this definition, “control” means thepower to direct the management and policies of anenterprise, or cause them to be directed, whether byvirtue of ownership of the shares or voting rights, bycontract or otherwise.

(A)

(B)

(C)

(D)

PreambleOn the hardware side, the Customer already uses one ormore gateways for its Machines, which are now to be replaced by one or more k.ey device(s) by KARL MAYER CHINA
in order to adapt to increased performance requirements on
the part of the KARL MAYER Group.
On the software side, KARL MAYER CHINA will in future provide the Customer with various cloud-based communicationand support options (“Solutions”) via a platform (the “Platform”, also called “myKM.ON”) as part of package offers(“Connectivity Packages”).
Services which KARL MAYER CHINA undertakes to provide
under this Agreement are partly provided by other companiesof the KARL MAYER Group, in particular by KM.ON GmbH.
The Parties are aware that in the dynamically developing fieldof “Industry 4.0”, adaptation requirements with regard to thisAgreement may arise at any time.

A.
General regulations; Solutions; Use of the Platform“k.ey device”

As defined in “Scope and version”.

“Delivery Data”

As defined in paragraph 3.1.

“Machine”

As defined in “Scope and version”.

“myKM.ON”

As defined in the preamble (B).

“Personal Customer Data”

As defined in item 3.6 and Appendix 2.

“PIPL”The Personal Information Protection Law of the PRC
effective as of November 11, 2021.

“Platform”

As defined in the preamble (B).

“PRC”

The People’s Republic of China.

“Solutions”

As defined in the preamble (B).

“SLA”

Service Level Agreement – Dashboard Lite and Remote
Services.

“Statistics Function”

As defined in Appendix 1 Annex A item 2.5“Overview Page”

As defined in Appendix 1 Annex A.

“Transfer”

As defined in paragraph 6.2.

“Networkable Machine”

As defined in Appendix 1 Annex B item 3.1.

“Networked Machine”

As defined in Appendix 1 Annex A.

“Agreement”

As defined in “Scope and version”.

1.	
1.1

Solutions; Plattform
The Customer can obtain services of the KARL MAYER Group
via the Platform. For the purchase of goods and services fromother companies of the KARL MAYER Group as well as via theweb shop, the separate respective provisions apply. The Customer can view the respective status of the Solutions bookedwith the Connectivity Packages on the Platform.

2.	Confidentiality
2.1 In the course of the contractual relationship between the
Customer and KARL MAYER CHINA, information requiring­secrecy will be disclosed and exchanged (the “Confidential­Information”). That “Confidential Information” comprises(a) all information of an economic, commercial, technical orother confidential nature, in particular all specifications,­descriptions, sketches, drawings, designs, sections, samples,data, inventions, formulae, procedures, plans, programmes,
models, findings, experience and know-how (relating to thek.ey device, for example);(b) the contents of this Agreement and the Solutions provided under other agreements and as part of the Connectivity
Packages;(c) Functioning, layout and design of the area of the Platform
accessible only to the Customer;(d) Information that KARL MAYER CHINA expressly designates as confidential, with the exception of information that
falls under item 2.5.
2.2 The Parties shall not disclose the Confidential Information or
make it accessible to third parties. Copies may be made only
for proprietary use; all Confidential Information must be
stored in such a way that third parties cannot gain knowledgeof it.
2.3 The Customer shall use the Confidential Information exclusively for the use of the k.ey devices, Platform and Solutions,but not for other business purposes, in particular not for its
own Platform-related projects; to develop products similar to
the k.ey devices, Platform and Solutions; or to promote Platform-related projects or develop third party products similar
to the k.ey devices, Platform and Solutions.
2.4 The confidentiality obligations assumed under sections 2.2
and 2.3 shall apply – without prejudice to the provision inpage 3 / 18

2.5

2.6

3.	
3.1

3.2

s­ ection 2.5 – without limitation as to time and place. In particular, they shall also apply after the end of the contractual
relationship based on the Agreement.
The confidentiality obligations do not apply to knowledge orinformation(a) that was already obvious or generally known at the timeof their communication to the Customer or to KARL MAYER
CHINA;(b) that was already known at the time of the disclosure to
the Party receiving the information;(c) that subsequently becomes obvious or common know­
ledge or state of the art, without any fault on the part of theParty who originally received the Confidential Information;(d) that was disclosed or made accessible to KARL MAYER
CHINA or the Customer by a third party authorised to do so;(e) to whose transfer, disclosure or provision to third parties
KARL MAYER CHINA or the Customer has previously consented in writing.
The burden of proving the existence of an exception in theabove sense shall be on the Party who invokes the existenceof the exception.
During the term of this Agreement and after its termination,
the Customer and KARL MAYER CHINA shall not reverse engineer, analyse and/or reconstruct Confidential Information thathas been transferred to them (ban on reverse engineering).
Rights to data; Processing of data; Protection of secrets
KARL MAYER CHINA is entitled to use the non-personal data
received from the Customer during the term of this Agreement in connection with the business relationship. Such data
are essential for KARL MAYER CHINA to provide the Solutions
under this Agreement as ordered by the Customer and could
include machine data (such as usage type and duration, load,condition, and status and error messages), environmental data
(temperature, humidity, and air pressure) and machine-related
network data (access, bandwidth usage, communication, andinteraction); k.ey device-related data (network information,­access information, and utilisation) (collectively the “Delivery
Data”). The Customer agrees and undertakes to (i) only provide
to KARL MAYER CHINA and upload to the Platform the (limited) scope of Delivery Data as required to enable the Solutions,and (ii) strictly follow the respective requirements on content,
format, quantity, channel/interface, etc. as agreed between
the Parties under this Agreement.
The Customer hereby grants KARL MAYER CHINA and all thecompanies of the KARL MAYER Group the worldwide, exclusive, irrevocable, sublicensable right to process the Delivery
Data anytime and anywhere, with no restrictions of content,
as far as allowed by applicable statutory laws. (including inparticular the right to access the Delivery Data regardlessof their storage location, to process them, and to store them­beyond any end of the Agreement) to the extent permitted
by applicable laws including the PRC laws. In particular, theCustomer acknowledges that KARL MAYER CHINA and all
the companies of the KARL MAYER Group may(a) access the Delivery Data regardless of the data’s location(Machine, k.ey device, the Customer’s network, Platform, ortransmission paths);(b) evaluate Delivery Data with algorithms and train machinelearning models;(c) use Delivery Data for advertising and marketing purposes;(d) provide other companies of the KARL MAYER Group with
the Delivery Data;

3.3

3.4

3.5

3.6

(e) provide suppliers of KARL MAYER CHINA with Delivery
Data to the extent that their respective supplier products(components, software, etc.) are affected by the Delivery Data.
With this Agreement, the Customer also expressly grants therights specified in sections 3.1 and 3.2 to KM.ON GmbH,­registered in the Commercial Register of the Local Court ofFrankfurt am Main under HRB 110267.
Insofar as any data (including that generated out of receiving
and processing of the Delivery Data) is provided to the Customer by KARL MAYER CHINA or any other member company of the Karl Meyer Group, the Customer may only use suchdata by itself for the purposes described in this Agreement
which shall be in strict accordance with the following conditions: The Customer shall not transfer such data to any third
party without KARL MAYER CHINA’s express written consent.
In particular, the Customer shall not provide such data to any
competitor of KARL MAYER CHINA or any other member
company of the Karl Meyer Group. The Customer shall not
extract or reuse content from the Platform and the Solutions
without KARL MAYER CHINA’s express written consent beforehand.
The servers used by the KARL MAYER Group are secured inaccordance with the state of the art, particularly by firewalls.
Each time KARL MAYER CHINA uses cloud services for thefulfilment of this Agreement, it shall make sure, as far as reasonable, that the respective cloud services ensure they use
servers which are protected according to the state of the art.
KARL MAYER CHINA and its affiliates may rely on statements
regarding the safety and performance of the respective service providers and is not required to perform its own technicalinspection. Applicable data protection law remains unaffected by this.
Subject to the Customer’s obligation in the last sentence ofClause 3.1 above, KARL MAYER CHINA and the Customer­acknowledge that, to the best of their knowledge, the Delivery
Data transmitted within the scope of this Agreement (via the
Platform or the k.ey device, for example) do not contain any
personal information. Insofar as KARL MAYER CHINA needs
to process any Customer’s personal information in the senseof Art. 4 PIPL (“Personal Customer Data”) in connection
with the provision, operation, support and maintenance of the
Solutions and the Platform, the Customer must guarantee
and secure that it has properly obtained statutorily requiredconsent from corresponding data subjects in advance so as
to enable KARL MAYER CHINA to legally process Personal
Customer Data.

4.	Information on Solutions and k.ey devices; Quality
specifications; Product information and labelling
4.1 Product documents, illustrations, details of performance,
weights and dimensions are as accurate as possible. Unlessotherwise stated or agreed, these only represent approximate
values and in particular do not constitute a statement of­condition or a guarantee.
4.2 Any legally required labels (such as CCC labels) on or relating
to the Solutions or k.ey devices, as well as batch numbers orother identification features, do not constitute quality specifications or guarantees vis-à-vis the Customer, but are affixed by
KARL MAYER CHINA on the basis of statutory provisions incompliance with KARL MAYER CHINA’s regulatory obligations.
4.3 The Customer shall read the associated product information
carefully before using the Solutions and the k.ey devices anduse the Solution and the k.ey devices with due care.

page 4 / 18

5.	
5.1
5.2

5.3

5.4

5.5

5.6

6.	
6.1

6.2

Liability; Limitation of liability
Unless this Agreement or statutory law states otherwise­explicitly, the liability provisions of this item 5 shall apply.
The liability of KARL MAYER CHINA for any breach of thisAgreement is limited to damage that was foreseeable whenthe Agreement was entered into and is typical of the type of
the Agreement.
KARL MAYER CHINA is liable for defects that exist when thecontract is formed only if (i) it knew (or if not for gross negligence, should have known) about the defect or (ii) KM.ON is
responsible for the existence of the defect when the contract
is formed.
Insofar as the liability of KARL MAYER CHINA is excluded orlimited, the liability for culpability of KARL MAYER CHINA’s representatives, employees and vicarious agents is also excluded.
Limited Liability (subject to below Clause 5.6 below): any lia­
bility of KARL MAYER CHINA under this Agreement (including
liability for non-conforming products and services) shall be restricted to direct losses and direct damage caused by a breachof contract or otherwise, and in no event should either it incur
any liabilities under this Agreement in excess of and in no
event shall the Customer be liable under this Agreement for
more than the fees actually paid by the Customer to KARL
MAYER CHINA under this Agreement.
KARL MAYER CHINA’s liability for indirect, consequential orincidental losses or damage of any kind or character (including
without limitation loss of profits or revenues, loss of business,
loss of use, losses due to work stoppages, and damage to reputation) shall be excluded. The same shall also apply if liabilityof KARL MAYER CHINA arises or is asserted on the basis of
tort (in­cluding breach of statutory duty) or arises otherwise.
The above limitation shall not apply if KARL MAYER CHINA
is liable to the Customer for property losses caused either
wilfully or as a result of gross negligence, and shall further
not apply if KARL MAYER CHINA is liable for bodily harm of
the Customer.
Service provision by the KARL MAYER Group; Transfer
In order to provide the Customer with the benefits of a single
point of contact, KARL MAYER CHINA is the Customer’s contract partner with respect to the services under this Agreement. Particularly regarding the provision of individual software components contained on the k.ey device and regarding
the services included in the Connectivity Packages, however,
KARL MAYER CHINA cannot take action itself. Due to thestructure and organisation of the KARL MAYER Group, individual companies of the KARL MAYER Group and/or suppliersof the KARL MAYER Group of Companies take action. The
Customer therefore consents to the direct provision of services
by companies of the KARL MAYER Group and by suppliers of
the KARL MAYER Group.
The Customer hereby approves that KARL MAYER CHINA
may transfer the rights and obligations under this Agreement
to third parties particularly including to another company of
the KARL MAYER Group, be replaced as a contracting party,
and withdraw from the Agreement (“Transfer”).

7.	Applicable law; Arbitration clause; Severability clause;
Singular and plural formulations; Contract amendments
and written form
7.1 This Agreement shall be governed by the law of the People’s
Republic of China (excluding the law of Hong Kong, Macau
and Taiwan).

7.2

7.3

7.4

7.5

7.6
7.7

The registered address of KARL MAYER CHINA as shown in
its business license is the exclusive place of performance forall delivery and payment obligations.
All disputes arising out of or in connection with this Agreement or concerning its validity shall be finally settled by­arbitration with the Shanghai International Arbitration Center(SHIAC) in accordance with SHIAC’s rules in force at the time
when the dispute is submitted for arbitration. There shall be
one arbitrator for the case and the place of arbitration shallbe Shanghai. The arbitral award shall be final and binding
upon the Parties. During the arbitration proceeding, theAgreement shall continue to be executed by the Parties­except for the part which is under arbitration. The costs of
the arbitration and of the Parties shall be borne by the losing­Party in the percentage it loses the case.
If any provision of this Agreement is or becomes invalid, unimplementable or unenforceable in whole or in part (“Defective
Provision”), the validity and enforceability of the remaining
provisions shall not be affected. Rather, the Parties undertaketo replace the Defective Provision with a provision that comesas close as possible to what the Parties would have agreed inaccordance with the meaning and purpose of this Agreement
if they had recognised the defectiveness of the provision. If
the defectiveness of a provision is based on ascertaining acertain level of performance or a certain point in time (deadline or fixed date), the provision shall be deemed to be agreed
with that level or point in time which comes as close as thelaw allows to the original level or point in time. The same
­applies to any gap in this Agreement.
An invalid provision shall be replaced by a valid provision thatcomes closest to the intended economic purpose. The same
shall apply if the implementation of this Agreement reveals a
gap that needs to be filled.
Terms and definitions in the singular include the corresponding definitions and terms in the plural and vice versa.
Individual Agreements made in individual cases between the
Customer and KARL MAYER CHINA (including ancillary agreements to this Agreement) take precedence over this Agreement. For the content of such agreements, a written agreement or the written confirmation of KARL MAYER CHINA isdecisive – subject to proof to the contrary. All legally relevant
declarations and notifications by the Customer in connection
with this Agreement (e.g. setting of deadlines, notifications ofdefects, withdrawal, termination or reduction) must be madeusing the written form, i.e. in writing or text form (e.g. letter,e-mail, fax), unless another form is agreed in this Agreement,
for example with regard to declarations via the Platform.
B.
Provision and maintenance of the k.ey device

8.	
8.1

8.2

Subject of the Agreement
This part of the Agreement governs the provision of the k.ey
devices by KARL MAYER CHINA and the obligations arising
for the Parties in this context.
In order to use the Platform and to provide the Solutions inaccordance with the Connectivity Packages, the Customer’smachines must be connected to the internet via a k.ey device.

9.	Hardware-related obligations and rights of KARL MAYER
CHINA within the scope of the transfer of the k.ey device
9.1 KARL MAYER CHINA shall transfer the required number ofk.ey devices as determined by KARL MAYER CHINA according

page 5 / 18

9.2

9.3

to Clause 9.2 to the Customer, who will not be required to pay
a fee for this. KARL MAYER CHINA shall provide the software
belonging to the k.ey device on a loan basis in accordancewith the clause 10.
KARL MAYER CHINA shall at its own dutiful discretion uni­laterally determine the number of k.ey devices required by
the Customer. The number regularly depends on the number,
type and use of the Networkable Machines.
KARL MAYER CHINA may exchange k.ey devices for newer
versions or another comparable product during the termof the Agreement. KARL MAYER CHINA will announce an­exchange with reasonable notice (one week in advance).
The Customer shall grant KARL MAYER CHINA access to theaffected machines and k.ey devices during the Customer’s
normal business hours.

10.	Software-related obligations and rights of KARL MAYER
CHINA within the scope of the transfer of the k.ey device
10.1 KARL MAYER CHINA shall provide the Customer with thesoftware belonging to the k.ey device on loan for the term of
the Connectivity Packages according to Appendix 1.
10.2 KARL MAYER CHINA shall grant the Customer the non-exclusive, non-transferable and non-sublicensable right, limited intime to the term of the Connectivity Packages according toAppendix 1 and in place to the installation site of the­machines to be networked via k.ey device, to use the Software to achieve the contractual purpose of this Agreement.
10.3 KARL MAYER CHINA is entitled to make changes and adjustments to the software as well as to replace individual (software) components both by means of remote maintenance­access and by replacing the k.ey device, in particular,(a) insofar as KARL MAYER CHINA and/or a company of the
KARL MAYER Group is obliged to do so on the basis of its own
licence and/or contractual software agreements;(b) if such modification or adaptation is necessary for the
maintenance of the software in accordance with the state of
the art; or(c) a further development, improvement, upgrade or new­release status of the software or individual (software) components is available.
11.	Obligations of the Customer within the scope of theprovision and maintenance of the k.ey device
11.1 The Customer shall accept the k.ey devices provided in­accordance with clause 9.1 and put them into operation
promptly.
11.2 The Customer shall handle and operate the k.ey devices provided in accordance with Clause 9.1 carefully and in accordance with the instructions of KARL MAYER CHINA, with theCustomer’s normal diligence, but at least with the diligenceof a prudent merchant.
11.3 If the Customer does not comply with the standard of care set
out in item 11.2, it shall bear the expenses incurred by KARL
MAYER CHINA for inspecting a k.ey device (and the costs for a
new k.ey device, if the Customer requests one).
12.	No warranty extension through surrender of the k.ey
device; Liability
12.1 The delivery of the k.ey device shall not affect any warranty
claims still existing at the time of commissioning of the k.ey
device from the separately concluded purchase contract(s)for the machine(s), the scope of delivery of which also included the previous gateway, which is replaced by the k.ey device,and shall also not establish any new warranty claims for themachine. The foregoing shall apply mutatis mutandis to contracts of sale of the individual gateway which have not included delivery of machinery.
12.2 Notwithstanding clause 5, the following liability and warranty
provisions shall apply to the transfer of k.ey devices:(a) KARL MAYER CHINA is responsible only for intent andgross negligence.
(b) KARL MAYER CHINA is not required to pay interest on­arrears.
(c) KARL MAYER CHINA is liable only for material defects
and defects of title that KARL MAYER CHINA has fraudulently
concealed from the Customer.
(d) Warranty claims with regard to the k.ey device shall­expire one year after the date of commissioning of the k.ey
device, but not later than the expiry of the eighteenth (18th)month after delivery of the k.ey device to the Customer’s
place of business.
C.
Connectivity Packages
13.	 Object of the Connectivity Packages
13.1 The object of the Connectivity Packages is various Solutions
that the Customer can access via the associated platform
with the help of an internet-enabled smartphone or computer.
13.2 The content and scope of the Connectivity Packages, such as
the Solutions included, are set out in Appendix 1 to thisAgreement. Support and maintenance contracts to be concluded separately with regard to the machines with respect
to any hardware components are not included in the Connectivity Packages and not the object of the Solutions; these aregoverned by the purchase or service contract for the­Machines or hardware components.
14.	 Customer obligations
14.1 Within the scope of the implementation of this Agreement,
the Customer shall be responsible for providing all necessary
information as well as for providing and maintaining the hardware and network environment as well as the necessary­system environment; it shall oblige its users accordingly. The
hardware and network environment requirements are set out
in Appendix 1 Annex B, unless otherwise specified in thisAgreement. For the installation and maintenance of the k.ey
devices, the Customer shall grant KARL MAYER CHINA including its subcontractors access to the installation site of
the k.ey devices during normal business hours after giving
reasonable advance notice.
14.2 If the Customer does not fully comply with his obligations tocooperate, KARL MAYER CHINA will not be required to meetits performance obligations affected by this until the Customer has duly fulfilled its obligations to cooperate, provided thatthe fulfilment of the obligations to cooperate is significant forthe services owed by KARL MAYER CHINA under the contract. If KARL MAYER CHINA incurs additional expenses due
to a breach of the Customer’s duty to cooperate, the Customer must reimburse these expenses.
15.	 Obligations of KARL MAYER CHINA
15.1 KARL MAYER CHINA shall provide and maintain the Connectivity Packages described in Appendix 1 with the content andscope defined therein and to maintain it in case of or to prevent malfunctions.

page 6 / 18

16.	 Default in payment; Setoff
16.1 In case of default of payment by the Customer, KARL MAYER
CHINA is entitled to claim 5% of the default amount for eachdelayed day against the Customer as liquidated damages.
KARL MAYER CHINA reserves the right to further claim forcompensation if aforementioned liquidated damages are notsufficient to cover actual losses suffered by KARL MAYER
CHINA.
16.2 Unless otherwise permitted by PRC laws, the Customer is notentitled to set off its liabilities towards KARL MAYER CHINA
against any counterclaim it may have against KARL MAYER
CHINA.
17.	Delivery time; Force majeure; Reservation of self-delivery;
Early or partial deliveries; Amendments
17.1 KARL MAYER CHINA must confirm delivery and provision
deadlines in writing in order for them to be binding. Delivery
and provision periods shall commence on the date of the­order confirmation, but not before complete clarification of alldetails of the order and not before timely fulfilment of thecontractual obligations of the Customer, in particular with­regard to the hardware and network environment to be provided by the Customer.
17.2 If KARL MAYER CHINA is in default with the delivery or provision, the Customer must grant KARL MAYER CHINA a reasonable period of grace, which may not be less than two (2) weeks.
Only after this grace period expires to no avail is the Customer
entitled to withdraw from or terminate the Agreement.
17.3 Force majeure (including without limitation strikes, pandemics, and epidemics) that prevents KARL MAYER CHINA fromdelivering or providing through no fault of its own will result inan extension of the relevant delivery or provision period for as
long as this circumstance persists. If a delivery becomes unreasonable due to these circumstances, KARL MAYER CHINA
may terminate the Agreement by serving a written notice to
the Customer with immediate effect and KARL MAYER­CHINA shall not be held liable for such termination.
17.4 The Customer acknowledges that KARL MAYER CHINA’s due
performance of this Agreement heavily relies on supply fromits subcontractors (including services). The Customer hereby
agrees that if KARL MAYER CHINA does not receive its own
deliveries or does not receive them on time, it shall grant agrace period which shall be long enough to enable Karl Meyer
China to resume performance of the Agreement in a reasonable and practical way. Karl Meyer China shall not be held liable for breach of contract during this grace period. If upon expiry of such grace period KARL MAYER CHINA has not been
supplied with the solutions it has ordered or with the supplierproducts and services required for the production or provisionof the Solutions, KARL MAYER CHINA may terminate theAgreement by serving a written notice to the Customer withimmediate effect. Any statutory rights of withdrawal and­termination shall remain unaffected.
17.5 Early or partial deliveries are permissible unless they are­unreasonable for the Customer.
18.	Notice of defects; Claims for defects; No right ofwithdrawal; Use of the Remote Service Connection
18.1 Notwithstanding item 5, the following provisions of this item
shall apply to the Solutions to be provided under the Connectivity Packages.
18.2 The Customer shall inspect the k.ey devices and Solutions immediately after delivery or provision and – if provided for in theindividual case – test them. The k.ey devices and the Solutions
shall be deemed to have been approved by the Customer if the
Customer has not notified KARL MAYER CHINA of a defect (i)in the case of obvious defects without undue delay, but at thelatest within seven (7) calendar days after delivery or provisionof the Solution to the Customer or (ii) in the case of hidden defects also without undue delay, but at the latest within ten (10)calendar days after discovery of the defect.
18.3 If within the framework of this Agreement KARL MAYER­CHINA is owed the provision or transfer of a service or anitem temporarily, and a defect arises during the term of theAgreement, the Customer shall notify KARL MAYER CHINA ofthe defect within seven (7) calendar days after it arises.
18.4 The Customer must describe defects in detail so that KARL
MAYER CHINA is able to identify and remedy the defect.
18.5 With this Agreement, the Customer and KARL MAYER CHINA
are driving forward the digitalisation of the industry. The Customer will notify KARL MAYER CHINA of a defect exclusively
by using the Remote Service Connection. For this purpose,
the Customer shall comply with the process set out in­Appendix 1 for making warranty claims and for other main­
tenance requests. The Customer shall use this process for all
defects and regarding all support or maintenance requests
with regard to the Solutions, the k.ey devices and the Networked Machines.
18.6 If there is actually a defect and the Customer gives notice of
this defect in due form and time in accordance with clauses
18.2 to 18.5, KARL MAYER CHINA is initially obliged, at its
own discretion, to rectify the defect or to deliver or provide a
defect-free Solution (subsequent performance).
18.7 If KARL MAYER CHINA takes action on the basis of a notice of
defect without a defect having existed, the Customer shallcompensate KARL MAYER CHINA separately for the expenditure incurred.
18.8 With the exception of claims for damages due to defects,
claims for defects shall become time-barred twelve (12)months after delivery or provision of the Solutions to the­Customer.
18.9 The Customer is entitled to claims for damages due to defects only insofar as the liability of KARL MAYER CHINA is not
excluded or limited in accordance with sections 18.1 to 18.8.
18.10 The provisions of this clause 18 do not affect claims for defects which KARL MAYER CHINA has fraudulently concealedor which are covered by a guarantee of quality or durability.

List of Appendices and Annexes
Appendix 1 Content and scope of the Connectivity Packages
Annex A Product data sheet; k.management; Dashboard
Lite
Annex B Hardware requirements, network requirements
and necessary system environment
Annex C Service Level Agreement – Dashboard Lite and­Remote Services
Appendix 2 Data Processing Agreement for the Connectivity
Terms and Conditions with associated annexes

page 7 / 18

Appendix 1:
Content and scope of the Connectivity Packages
Summary Framework Connectivity Packages
Costs

RMB 100,00 net per Networked Machine per month formechanical machines (N-drive).
RMB 150,00 net per Networked Machine per month forelectronic machines (ON, EL, EN drive, etc.) with bidirectional
data transfer.

Term

Beginning with registration of the machines on the Platform
for the Connectivity Packages, but no later than three (3)months after conclusion of the contract: Twelve (12) months(“Accounting Year”).
The contract will renew tacitly for twelve (12) months eachtime if no notice of termination is given.

Termination

The contract may be terminated through ordinary termination
at the end of any month with three (3) months’ notice.
Extraordinary termination without prejudice.

Invoicing

Per Accounting Year (12 months).

Payment

Company name: Karl Mayer (China) Ltd.
Beneficial bank: ICBC Changzhou Hutang Branch
Account no.: 1105021219008888686
Payments in the final year by cash in advance, in the further
Accounting Years annually after invoicing and due datestipulated there by KARL MAYER CHINA at the beginning of
the Accounting Year; the timely receipt of payment into theaccount of KARL MAYER CHINA is decisive.

Price adjustments

KARL MAYER CHINA may notify the Customer of priceadjustments four (4) weeks before the expiry of the ordinary
notice period. If the Customer makes no response, the priceadjustment shall be deemed to have been approved by the
Customer. KARL MAYER CHINA will point out this approval by
default in the price adjustment letter.
If the costs per Networked Machine according to this table shall
automatically change, without the need for a request, by
seventy (70) per cent of the index change that has occurred.
The price changes from the beginning of the next monthfollowing the first attainment of the percentage change, for the
first time at the beginning of the first Accounting Year. If theprice change leads to a short or over payment by the Customer,
KARL MAYER CHINA will settle this by invoice.
The right of KARL MAYER CHINA to terminate the contract due
to changes remains unaffected.

Components of theConnectivity Packages

k.ey device(s), if required, see item 9 of the Agreement.
SaaS solution Dashboard Lite, in accordance with item 19 of
this Appendix 1.
Remote Service Connection, in accordance with item 20 of thisAppendix 1.
Remote Set-Up and Installation Support for Connectivity, in
accordance with item 21 of this Appendix 1.

Hardware requirements, Annex B
network requirements,
and necessary system
environment

19.	 SaaS Solution Dashboard Lite
Specifications for the content and scope of the Dashboard Lite
Software-as-a-Service Solution are set out in Annex A to thisAppendix 1. Service Level Specifications relating to the Dashboard
Lite are set out in Annex C to this Appendix 1. Services under theService Level Agreement set out in Annex C to this Appendix 1 shallbe provided by KM.ON GmbH.
20.	 Remote Service Connection
20.1 The Customer shall follow the following process when making warranty claims and otherwise requesting maintenance:• 
Step 1: The Customer triggers a service request with KARL
MAYER CHINA via the myKM.ON Platform. There is a­“Remote Service” button on the Platform for this purpose.
After its activation, the Customer is shown all the Machines
for which it has entered into a Connectivity Packages.
• 
Step 2: The Customer generates a ticket at KARL MAYER
CHINA and confirms the permission of the companies of the
KARL MAYER Group for remote access with regard to the
Networked Machines concerned.
• 
Step 3: The Customer accepts the feedback from the­service-providing unit of a company of the KARL MAYER
Group. Service Level Specifications relating to the Dashboard Lite are set out in Annex C to this Appendix 1.
20.2 The access authorisation regarding Networked Machines
within the scope of remote access is not limited to KARL
MAYER CHINA. The Customer grants access to its Networked
Machines to each company of the KARL MAYER Group and, tothe extent necessary, to its suppliers, if any. This access authorisation is a necessary prerequisite for the respective company of the KARL MAYER Group to be able to fulfil warranty
claims or maintenance orders requested by the Customer.
20.3 The Remote Service Connection does not include any troubleshooting/maintenance or repair service by KARL MAYER­CHINA, but creates the prerequisite for a company of the
KARL MAYER Group to be able to provide the Customer withthe services contractually owed by other contracts that may
have to be concluded (e.g. remote instructions for troubleshooting within the scope of the warranty or outside of thewarranty (separate service subject to a charge).
21.	 Remote Set-Up and Installation Support for Connectivity
21.1 KARL MAYER CHINA provides remote support for networking
the Networkable Machines for which the Connectivity Packages exists. KARL MAYER CHINA will instruct the Customer
remotely on how the Customer can establish a connection of
the k.ey device with the machines to be networked and theplatform. Included in Remote Set-Up and Installation Support
for Connectivity is support by phone, email or chat (Microsoft
Teams) from service representatives. KARL MAYER CHINA is
not responsible for any connections through remote access to
the Networkable Machines concerned.
21.2 In order for a company in the KARL MAYER Group to provide
the service described in item 21.1 of this Appendix 1, KARL
MAYER CHINA and the Customer will arrange an appointment. KARL MAYER CHINA shall respond to the Customer’s
appointment request within one (1) working day (by e-mail /telephone).

page 8 / 18

Annex A:
Product data sheet; k.management; Dashboard Lite
Preliminary remarks: What follows is an abstract scope of services
for the “Dashboard Lite” Solutions, which belongs to the k.management. Whether the Solutions described herein are available to theCustomer shall be determined by the specific agreements on thecontent and scope of the Connectivity Packages in Appendix 1 tothis Agreement.
1.	
1.1

1.2
1.3

1.4

Dashboard Lite – Overview
Dashboard Lite is a cloud-based k.management Solution
within the Machine Data Visualisation Platform (“Dashboard
Lite” or “Dashboard”).
Access to the dashboard is browser-based via login throughthe myKM.ON Platform.
In principle, processed machine data from Networkable­Machines can be displayed. Details of the hardware requirements and network requirements are set out in Annex B tothis Agreement. On the landing page of the dashboard, all
Networkable Machines that the customer has networked via
the k.ey device (the “Networked Machines”) are displayed as
an overview (the “Overview Page”).
The Dashboard Lite is available for Warp Knitting KAMCOS 1
and KAMCOS 2 systems. To the extent that functionalities­differ with respect to individual Networked Machines, suchdifferences shall also result from the specifications in item 2of this Annex A.

2.5

Annex B:
Hardware requirements, network requirements, and necessary
system environment
1.	

2.	

2.1

2.2

2.3

2.4

• Production output for the piece currently in production(in length / time unit);• Current speed of the Networked Machine in production(in revolutions / time unit);• Selected information about the Customer’s order currently
being produced on the Networked Machine (e.g. Customer’s
article and order number; number of pieces per order). The
prerequisite is that this information has been entered in therespective KAMCOS system beforehand, whereby there
may be restrictions depending on the KAMCOS system(e.g. order data not possible with KAMCOS 1);• Information on the warp beams of the respective­Networked Machine;• Information on goods take-off and roll-up.
Statistics function
In addition, it is possible to retroactively evaluate historical
production data of the concrete Networked Machine (the “Statistics Function”). The Statistics Function contains a historical
overview of the “Machine status (running, stopped, or offline)”of the respective Networked Machine, whereby the following
time periods can be selected:• Last 1 h;
• Last 8 h.

Specification and description of the Dashboard Lite
Where a Machine is covered by this item, the Dashboard Lite
shall include the following functions:
Overview of all Networked Machines
In Dashboard Lite, the Overview Page displays the following
machine information of all Networked Machines as live dataat the respective Networked Machine:• Machine name as stored in the respective KAMCOS system;• Machine status (running, stopped, or offline);• Remaining time until the source material is completely­processed;• Remaining time until completion of the piece currently in
production;• Number of stops during the production of the current piece;• Percentage information on the running time of the respective Machine in production operation in the last 24 hours(rolling: e.g. 11.01. 15:00 until 12.01. 14:59).
Filter function
Using the filter function “Machine status (running, stopped, or
offline)”, the Networked Machines can be filtered accordingly
on the Overview Page. It is also possible to filter individual
Networked Machines on the Overview Page by entering themachine name or the serial number of the respective Net­
worked Machines.
Sorting functions
The Customer can sort all Networked Machines on the Overview Page by “Machine name A–Z”.
Individual evaluation of the live data of a Networked Machine
By clicking on a specific Networked Machine on the Overview
Page, the following further information on the specific Networked Machine can be called up as live data:• Information on the Networked Machine itself (machine type,serial number, total operating hours and version of the
KAMCOS system);
page 9 / 18

k.ey device
The platform requires a properly connected and functioning
k.ey device in order to interact with Networkable Machines.
To the k.ey device:(a) Technical data k.ey device:(i)	Dimensions and weight:
Dimension: 180 x 134 x 50 mm
Weight: approx. 1.0 kg(ii)	Operating conditions:
The installation site of the k.ey device must be chosen
so that it is operated under IT conditions.
This particularly concerns the following requirements:
Operating temperature: 0–40 degrees Celsius;
Relative humidity: 10–90% at 39 degrees Celsius(non-condensing).
(b) Network requirements
The trouble-free operation of the k.ey device requires that theCustomer maintain the following minimum requirements onsite continuously (24/7) and provide the hardware components required for this purpose, which are not included in thescope of delivery of the k.ey device, at its own expense.
(i) General requirements (LAN and WLAN):• CAT-5e cable (or higher category);• Machine network (LAN), Ethernet recommendation,
WiFi optional;• Internet router / internet connection;• Configure the firewall to reach the required hosts/ports.
The software required for this is currently available in
the Quick Start Guide;• DNS server;• IP address range (LAN and WLAN);• Recommended: Static IP address assignment for k.ey
device and Machines to be networked.

(ii) Special requirements:	Depending on the type of networking chosen, the Customer must also meet the following requirements.
(A)	Networking via LAN connection (recommended by
KARL MAYER):
		 •	Access to the internet via LAN 1 (WITH network
separation) or LAN 3 (WITHOUT network separation) in the k.ey device permanent access tothe internet via LAN 3;		 •	Access to the Machine network via LAN 1 (withnetwork separation) or LAN 3 (without network
separation);		 •	Unrestricted internet access of the k.ey device
with a bandwidth of at least 10 Mbit/s.
		•	Network cable:			 • LAN cable from machines to switch;			 • LAN cable between switch and k.ey device;			 • LAN cable from the k.ey device to the internet
router.
		 • Other hardware:			 • If necessary, LAN adapter (for KAMCOS 1­machines, for example).
(B) Networking via WLAN connection		 •	Access to the internet via LAN 1 (WITH network
separation) or LAN 3 (WITHOUT network separation) in the k.ey device.
		 •	Unrestricted internet access of the k.ey device
with a bandwidth of at least 10 Mbit/s.
		•	Network cable:			 • LAN cable between WLAN antenna andswitch;			 • LAN cable between switch and k.ey device;			 • LAN cable from the k.ey device to the internet
router.
		 • Wifi equipment:			 • WLAN antenna/s (WLAN access point).
		 • Other hardware:			 • If necessary, WLAN antenna for KAMCOS 1 &KAMCOS 2 Machines (local on the Machine).
(c) Software
As delivered, the k.ey device is equipped with a Linux operating system and pre-installed basic software to ensure operation and maintenance of the k.ey device. The provisions of
item 10 of this Agreement shall apply to the software, in­particular its transfer.
(d) Electrical equipment:• Power supply unit: 110V /230 V• Supply input: 100–240 VAC• Frequency of supply: 50 Hz / 60 Hz• DC output: 24 VDC(e) Interfaces:• 1 x HDMI / 1 DP (Display Port)• 4 x USB 3.0• 2 x RJ 45 (10/100/1000)• 1 x RJ 45 (Support)(f) Initial commissioning of the k.ey device
For the initial commissioning of the k.ey device, a one-timeregistration with the personal company email address of an
employee of the customer on the myKM.ON Platform of
KM.ON GmbH is necessary (currently accessible at https://go.kmon.net or for PRC https://go.kmon.net.cn). The corresponding processing of Personal Customer Data is carried out
in accordance with Appendix 2. Only after this registration isit possible to onboard the k.ey device itself and to access the
Quick Start Guide (currently available at https://go.kmon.net/
key/quicstartguide) for instructions on commissioning thek.ey device. The Quick Start Guide also contains suggestions
for setting up the network environment to be created by the
Customer as well as the URLs and ports to be released by the
Customer.
For the onboarding process, the Customer needs, in addition
to the network requirements to be created by the Customer: alaptop and a LAN cable with RJ 45 connector.
General information on the k.ey device can be found athttps://www.karlmayer.com/de/key/.
2.	
Customer terminal
The Customer requires a commercially available mobile or
stationary device to access the Platform and/or Networked
Machines (such as a smartphone, laptop with active W-LAN andinternet connection) (“End Device”).
3.	Hardware requirements and network requirements related
to the Machine and Connectivity Packages, as well as thenecessary system environment
The basic prerequisite for using Solutions is the existence of a
Networkable Machine. Furthermore, depending on the Solutions
included in the respective Connectivity Packages, they havedifferent requirements.
3.1 Networkable Machine
The following Machines can be networked in principle:• Warp knitting machines of the KARL MAYER Group, provided they are operated with the operating system KAMCOS 1(all versions) or KAMCOS 2 (from version V3.9.0.263).
• Possible for warp knitting machines with the KAMCOS 1 operating system (from version V1.4.0.87), whereby additional
hardware components may have to be purchased in­advance by the Customer [adapter or WiFi antennas (perMachine potentially to be networked)]. In addition, the Customer may have to commission a KM service technician tocarry out any necessary software updates (when operatingwith a WiFi antenna), for which a charge will be made.
• In the case of warp knitting machines with an older­KAMCOS 1 operating system, clarify in advance with KARL
MAYER CHINA whether and under what conditions networking of the Machine is possible.
• For all other machines of the KARL MAYER group of companies as well as machines from third-party manufacturers, it must be clarified in advance with KARL MAYER­CHINA whether and under what conditions networking of
the respective machines is possible.
3.2 Dashboard Lite
The requirements for the k.ey device according to item 1 ofthis Annex B apply.
3.3 Remote Set-Up and Installation Support for Connectivity:
The requirements for the k.ey device according to item 1 ofthis Annex B apply.
Annex C:
Service Level Agreement – Dashboard Lite and Remote Services
1.	Scope of this Service Level Agreement – Dashboard Lite;
Relationship to the Agreement
1.1 This SLA contains specifications on the availability of the­Services provided by KARL MAYER CHINA via the myKM.ON
Platform of KM.ON GmbH, on the performance of Main­

page 10 / 18

1.2

1.3

1.4

tenance Work, the Remote Services and the Incident Management.
This SLA applies exclusively to the Service made available to
the Customer for productive use and not to non-productive,
free and/or test versions of the Service and the integration or
test systems with unreleased functions.
All obligations of KARL MAYER CHINA in this SLA apply only
to the Service provided to the Customer at the transfer point.
KARL MAYER CHINA is not responsible for the data trans­mission from the transfer point to the Customer and/or in thearea of the Customer’s IT system.
In the event of any conflict between this SLA and the Agreement, the provisions of this SLA shall prevail.

2.	Definitions
2.1 Besides the definitions in the Agreement, the definitions set
out in this item shall apply for the purposes of this SLA. In theevent of any inconsistency between the definitions in this SLA
and the definitions in the Agreement, the definitions in theAgreement shall prevail.
2.2 “Downtime” means the total number of hours during which
the essential functions of the Service, as defined in the­contract, are not available during the system term.
2.3 “Dashboard Lite” as defined in Appendix 1 Annex A.
2.4 “Incident Management” refers to the processing of Faults.
2.5 “Response Time” is the time period in which KARL MAYER
CHINA starts to process a Fault reported by the Customer.
2.6 “Remote Services” as defined in Appendix 1, item 2.
2.7 “Service” is the umbrella term for the Dashboard Lite andthe Remote Services, unless one of the two Services is­explicitly addressed in this SLA.
2.8 “Service Provision Time” As defined in item 3.1 of this Annex.
2.9 “SLA” This Service Level Agreement
2.10 “Fault” means any impairment of the Service, such as Downtime, errors or quality degradation.
2.11 “Transfer Point” Regarding the Dashboard Lite: Point at
which the data transfer from the Platform to the Customer’ssystem takes place. Regarding Remote Services: Point at
which the Remote Service leaves the network of KARL­MAYER CHINA or the company providing the Remote Service.
2.12 “Availability” means that the Customer can perform and use
the essential functions of the Service at the Transfer Point.
The Service is also available if the Customer can use the­essential functions of the Service by means of a work-aroundprovided by KARL MAYER CHINA at the Transfer Point.
2.13 “Maintenance Work” refers to all maintenance activities required to keep the Service running, troubleshoot the Service,back up data and/or activities required to improve, enhance orrenew functionality to ensure that the Service can be used inaccordance with the Agreement.
3.	Availability
3.1 KARL MAYER CHINA owes the agreed availability of the Service at the Transfer Point. The agreed availability is 96% permonth based on a provision time of 24 hours per day and 365
days per year with respect to the Dashboard Lite and with­respect to the Remote Services as agreed in item 4.1 of this
SLA (each the “Service Provision Time”).
3.2 KARL MAYER CHINA is not obliged to make the Service available for use by the Customer during planned MaintenanceWork in the Service Provision Time in accordance with item 6of this SLA. If the Service is available during scheduled Maintenance Work pursuant to item 6, use of the Service shall be

3.3

3.4

3.5

4.	
4.1

at the Customer’s own risk. The Customer acknowledges thatthe use of the Service may be limited in terms of functionality
or performance during scheduled Maintenance Work and/orthat the Service may be shut down or restarted without further notice. If the Service is provided during scheduled Maintenance Work and there is a reduction in the functionality of
the Service or a reduction in availability, the Customer shallnot be entitled to any warranty or compensation.
The availability of the Service is calculated as a percentage oftime over the course of a calendar month during the Service
Provision Time.
When calculating the actual availabilities, Downtimes thatcannot be attributed to KARL MAYER CHINA are considered
as available times. These harmless Downtimes are:(a) Downtime due to planned or unplanned MaintenanceWork in accordance with item 6;(b) Downtime due to Maintenance Work agreed in advancewith the Customer;(c) Downtimes due to operational disruptions caused by anevent of force majeure or other unavoidable events outside
the sphere of influence of KARL MAYER CHINA and which
could not be averted with reasonable effort and which could
not be foreseen even with careful application, which make theobligations of KARL MAYER CHINA under this SLA considerably more difficult or impossible in whole or in part, such as
epidemics, pandemics, strikes, lockouts, extraordinary weather conditions, power failures, operational or traffic disruptions
and transport hindrances, and which release KARL MAYER
CHINA from its obligations under this SLA for the duration ofsuch event;(d) Downtimes due to virus or hacker attacks, insofar as
KARL MAYER CHINA has taken the agreed protective measures or, in the absence of an agreement, the usual protective
measures;(e) Downtimes due to a malfunction caused by the Customer;(f) Downtimes due to software errors in the Customer’s applications or due to errors in the system and system-related
software triggered by the Customer’s applications or data;(g) Downtimes caused by Faults in the Customer’s hardware,with the exception of Faults in the k.ey device or in the­Networked Machine;(h) Downtimes caused by third parties (persons not attributable to KARL MAYER CHINA).
The Customer must notify KARL MAYER CHINA of any impairment of the availability of the Service.
Remote Services
The Service Provision Time of the Remote Services, which­depends on the location of the Networked Machine, is shownin the following table:
Asia (without
People’sRepublic ofChina andJapan)

People’sRepublic of
China

Japan

Rest of the world

Days

Monday –SaturdayMonday –SaturdayMonday –SaturdayMonday – Friday

Operatinghours

07:00–20:00(GMT+8)07:00–22:00(GMT+8)07:00–18:00(GMT+9)07:00–17:00(MEZ)

Language

EnglishEnglish / Chinese English

4.2

page 11 / 18

EnglishSupport includes a service desk for Customer incident ­reports through tickets and emails via connectivity-support@
karlmayer.com

5.	
5.1

5.2

Incident Management
Incident Management includes all activities between the­Customer and KARL MAYER CHINA in connection with thenotification and management of Faults until their resolution.
The following Fault Classes apply:(a) Faults within the Service are assigned to one of the­following Fault Classes, which determine the target Response
Time.

Fault Class

Description

1
CriticalA Fault is allocated to Fault Class 1 if
<12h during the Service
use of the Service or essential parts
Provision Time of the­thereof is completely unavailable or­Remote Services­severely restricted (due to malfunctions,
incorrect work results or response
times, for example).

2
Essential

A Fault is allocated to Fault Class 2 if
<12h during the Service
use of the Service or essential functiona- Provision Time of thelities is restricted (due to malfunctions, ­Remote Services
incorrect work results or long response
times, for example).

3
Insignificant

A Fault is allocated to Fault Class 3 if
<18h during the Service­insignificant functionalities of theProvision Time of the­Service are impaired, such as “nice to­Remote Services
have” functionalities or flaws that do not
impair the use of the Service.

4
Low

A Fault is allocated to Fault Class 4 if
use of the Service is not restricted atall (if the Customer asks questions or­requests improvements, for example).

5.3

6.	
6.1
6.2

6.3

6.4

Response Time<24h during the Service
Provision Time of the­Remote Services(b) KARL MAYER CHINA shall prioritise and classify Faults at
its own discretion, taking into account the aforementioned
definitions.
Incident Management Process(a) The Customer must inform KARL MAYER CHINA immediately of any Faults via the Platform, email, or ticket system(depending on which option KARL MAYER CHINA offers the
Customer).
(b) The Customer shall ensure that the notification of a Fault
contains the following required information:(i)	Name of the user account and Networked Machinesconcerned as well as the Service;(ii)	Detailed description of the Fault so it can be reproduced;(iii) Date and time when the Fault occurred;(iv)	Which troubleshooting measures have already been
carried out by the Customer and what behaviour has
been shown as a result of the Customer’s troubleshooting measures.
(c)	As soon as the Customer has provided KARL MAYER­CHINA with all the necessary information, the solution
process begins. KARL MAYER CHINA will then provide theCustomer with an initial response within the Response
Times specified in item 5.2. KARL MAYER CHINA will
­inform the Customer about the elimination of the Fault.
Faults are processed during the Service Provision Time of
the Remote Services.
Maintenance WorkKARL MAYER CHINA may interrupt the provision of the­Service for Maintenance Work.
KARL MAYER CHINA shall schedule Maintenance Work insuch a way that the Customer’s use of the Service is affected
as little as possible.
KARL MAYER CHINA shall notify the Customer of planned
Maintenance Work in the Platform at least five calendar daysin advance.
page 12 / 18

KARL MAYER CHINA may perform unscheduled maintenanceof the Service for an important reason (if the Service operation is endangered, for example). This includes without limitation emergency changes, such as the installation of security
patches, which are necessary to secure and maintain operations and require immediate implementation. KARL MAYER
CHINA shall notify the Customer of such unscheduled Maintenance Work without delay and carry it out in such a waythat disruptions to the operating process are kept to a minimum.

Appendix 2:
Data Processing Agreement for the Connectivity Terms andConditions
1.	
1.1

1.2

1.3

2.	
2.1

2.2

2.3

2.4

2.5

Definitions, starting point and ranking
The definitions in the Connectivity Terms and Conditions shallapply mutatis mutandis to this Appendix 2 (including the­Annexes), subject to the following variation: The Customer isalso referred to as the “Client” and KARL MAYER CHINA isalso referred to as the “Contractor”. The Connectivity Terms
and Conditions are referred to as the “Main Contract”.
The provision of services in the form of the provision, operation, support and maintenance of the Solutions and the Platform in accordance with the provisions of the Main Contract
requires the processing of personal information of the Customer within the meaning of Art. 4 PIPL (“Personal Customer
Data”) and processing of the Delivery Data. This Appendix 2
sets out the data protection obligations of the Customer and
KARL MAYER CHINA resulting from the processing of Personal Customer Data and Delivery Data in the context of the contractual provision and use of the Solutions and the Platform(“Data Processing”). The Customer shall be solely responsible for the lawfulness of the provision of Personal Customer
Data and Delivery Data to KARL MAYER CHINA.
If there is any inconsistency or ambiguity between a provisioncontained in the main body of this Appendix 2 and a provisioncontained in its appendices, the provision contained in themain body shall prevail. If there are contradictions or ambiguities between provisions of this Appendix 2 and provisions of
the Main Contract, the provisions of this Appendix 2 shall takeprecedence as far as data protection matters are concerned.
Object, duration, and specification of the Data Processing
The object of the Data Processing is the provision, operation,
support and maintenance of the Solutions and the myKM.ON
Platform by KARL MAYER CHINA for the Customer and its
users in accordance with the provisions of the Main Contract.
The details are specified in the Main Contract.
The term of this Appendix 2 corresponds to the term of theMain Contract. This Appendix 2 ends with the termination of
the Main Contract.
The scope, type, and purpose of the Data Processing is theprovision, operation, support and maintenance of the Solutions and the myKM.ON Platform in accordance with the provisions of the Main Contract by KARL MAYER CHINA as wellas the enabling of the contractual use of the Solutions andthe Platform by the Customer and its users. The details are
specified in the Main Contract.
The types of Personal Customer Data and the categories ofdata subjects are as follows:(a) Types of Personal Customer Data are (a) the user’s nameand email address, (b) the user’s role with the Customer, (c)the user’s IP address, and (d) an authentication token (~ individual characteristic that identifies the user for authentication
purposes within the Solutions and the Platform).
(b) Categories of data subjects are employees and workers of
the Customer.
The types of Delivery Data are defined in paragraph 3.1 of theMain Contract.
The Solutions and Platform is a global software solution.
Against this background, Data Processing occurs both within
the PRC and outside the PRC.
The Customer hereby authorise KARL MAYER CHINA totransfer the Customer Personal Data and Delivery Data to the
sub-processors/recipients listed in Annex 2 who are locatedoutside the PRC. Annex 2 specifies the measures approved by
the Customer to ensure an adequate level of data protection.
In case the Customer is aware of any statutory restriction or
prohibition on above data transfer, it shall immediately notify
KARL MAYER CHINA of such restriction or prohibition and­discuss a compliant solution with KARL MAYER CHINA. KARL
MAYER CHINA shall in no event be held liable for the delay
or failure to provide the Solutions due to such restriction or
prohibition on data transfer. In addition, the Customer shallbe solely responsible for all liabilities and losses arising fromits failure to (i) stay compliant with applicable data protection
requirements under Chinese laws, including e.g. data export
control, and (ii) notify KARL MAYER CHINA of above restriction or prohibition on data transfer including to find a legallyfeasible solution in a timely manner.
3.	
3.1

3.2

3.3

4.	
4.1

4.2

Technical and organisational measures
KARL MAYER CHINA takes all necessary technical and­organisational measures in its area of responsibility in accordance with the PRC laws on the protection of Personal
Customer Data and Delivery Data. The technical and organisational measures are specified in Annex 1. Annex 1 shall behanded over to the Customer for review and, if not objectedby the Customer in writing within the deadline as requested
by KARL MAYER CHINA, shall become the basis of this­Appendix 2.
Insofar as a review or inspection of the Customer reveals aneed to adapt the technical and organisational measures­listed in Annex 1, the Parties shall implement this by mutual
agreement.
The technical and organisational measures listed in Annex 1
are subject to technical progress and further development.
KARL MAYER CHINA may implement alternative adequate
measures, although the security level of the technical and­organisational measures specified in Annex 1 must be met or
exceeded. The Customer must be informed in writing or text
form of any significant changes.
Rights of data subjects
KARL MAYER CHINA supports the Customer within its area of
responsibility and as far as possible by means of suitable
technical and organisational measures in answering and­implementing requests from data subjects under data protection law. KARL MAYER CHINA may not disclose, port, rectify,
erase or restrict the processing of Personal Customer Data on
its own authority, but only after receiving documented­instructions from the Customer. If a data subject contacts
KARL MAYER CHINA directly, KARL MAYER CHINA shall­forward that request to the Customer without undue delay.
KARL MAYER CHINA may demand appropriate remuneration
for the support of the Customer in the case of enquiries fromdata subjects.
Insofar as this is possible within the scope of the functionalities of the Solutions and the myKM.ON Platform, the Customer itself shall correct, erase or restrict Personal Customer
Data.

5.	Quality assurance and other obligations of KARL MAYER
CHINA
Furthermore, KARL MAYER CHINA has the following obligations:page 13 / 18

5.1

5.2

5.3

5.4
5.5

5.6

5.7

5.8

5.9

6.	
6.1

KARL MAYER CHINA and anyone subordinate to them who
has legitimate access to Personal Customer Data and Delivery Data shall process those data exclusively in accordancewith the provisions of the Main Contract, this Appendix 2, andthe instructions of the Customer in order to provide the Solutions and the Platform in accordance with the Agreement,­unless they are legally obliged to process it differently.
To maintain confidentiality of the data, KARL MAYER CHINA
uses only employees in the performance of its activities who
have been obligated to confidentiality and have been familiarised with the data protection provisions relevant to them.
KARL MAYER CHINA employees are informed that the con­fidentiality obligation pursuant to this item 5.2 shall survive
the termination of their employment. A statutory duty of­disclosure remains unaffected by this.
KARL MAYER CHINA supports the Customer, taking into account the nature of the Data Processing, to the necessary andappropriate extent in ensuring compliance with the legal obligations.
KARL MAYER CHINA’s data protection officer can be reachedat the following contact details:
KARL MAYER CHINA shall inform the Customer without undue delay about measures and inspections by a supervisory
authority regarding the Data Processing. The same applies inthe event of investigations by a competent supervisory authority in the context of administrative offence or criminal
proceedings.
To the extent the Customer is exposed to (a) the control of asupervisory authority, (b) an administrative offence or criminal
proceedings, (c) the liability claim of a data subject or a third
party or (d) another claim or a request for information in connection with this Appendix 2, KARL MAYER CHINA shall support the Customer to the necessary and reasonable extent.
KARL MAYER CHINA regularly monitors its internal processes as well as the technical and organisational measures(cf. Annex 1) to ensure that the Data Processing in its area of
responsibility is carried out in accordance with the requirements of the applicable data protection law and that the­protection of the rights of the data subjects is guaranteed.
KARL MAYER CHINA supports the Customer in its area of­responsibility and, as far as possible, within the scope of existing duties to provide information to supervisory authorities
and data subjects to the necessary and appropriate extent
and provides the Customer with all relevant information inthis context.
KARL MAYER CHINA shall provide the Customer in its area of
responsibility with all information necessary to prove compliance with the applicable data protection laws and enable andsupport controls regarding the Data Processing within thescope of this Appendix 2 (cf. item 7).

6.2

Sub-processing relationships
For the purposes of this item 6, subcontracting relationships
shall be understood to mean those services which relate directly to the provision of the Solutions and the Platform. This
does not include any ancillary services that KARL MAYER
CHINA makes use of (such as telecommunications, transport,
or cleaning or security services). However, KARL MAYER CHINA
shall make appropriate and legally compliant contractual
agreements and take control measures to guarantee the dataprotection and the data security of the Personal Customer
Data and Delivery Data, including in the case of outsourced
ancillary services.

7.2

6.3

6.4
6.5

7.	
7.1

page 14 / 18

The sub-processors approved by the Customer when theagreement was entered into are listed in Annex 2.
A further commissioning of sub-processors or the replacement of existing sub-processors in accordance with Annex 2
is permissible under the following conditions:(a) KARL MAYER CHINA notifies the Customer of the involvement of the sub-processor in advance in writing or text form
within a reasonable period of time, which must be at least
fourteen (14) days, and the Customer explicitly approves thisin writing. Insofar as the Customer objects and the Parties
cannot reach an amicable solution regarding the sub-processor in question, KARL MAYER CHINA will not commission
such sub-processor and shall not be held liable for its failure
to provide the Solutions and the Platform in accordance with
the Main Contract if they are so affected by Customer’s objection.
(b) KARL MAYER CHINA enters into agreements with the
sub-processors in accordance with the PRC laws, which­contain data protection provisions that are comparable inprinciple to this Appendix 2 applicable between the Parties.
In particular, KARL MAYER CHINA shall ensure that sufficientguarantees exist for implementing technical and organisational measures. The sub-processor further grants the Customer audit and control rights essentially comparable to item
7, including the right of the Customer, on written request, toreceive information from KARL MAYER CHINA on the content
and implementation of relevant data protection obligations
within the scope of the sub-processing relationship (if applicable, by inspecting the related documentation).
If the sub-processor provides the agreed service outside the
PRC, item 2.5 shall apply accordingly.
KARL MAYER CHINA remains responsible to the Customer
for the fulfilment of the obligations of the commissioned
sub-processor.
Control rights of the Customer
The Customer may verify compliance with (a) the applicabledata protection obligations as well as (b) this Appendix 2,­particularly regarding the technical and organisational­measures. The Parties have the common understanding thatchecks of the Customer and the provision of information andevidence by KARL MAYER CHINA for compliance with the­applicable data protection obligations and this Appendix 2
will primarily be carried out in such a way that KARL MAYER
CHINA provides the Customer with current test certificates,
reports or report extracts from independent third parties(such as auditors, auditing departments, data protection­officers, IT security department, data protection auditors or
quality auditors) or suitable certifications by IT security ordata protection auditing. This will not affect the Customer’s
rights under items 7.2 or 7.3.
To the extent necessary in individual cases and at customer’s
own costs, during the term of this Appendix 2 and upon priorcoordination with KARL MAYER CHINA, the Customer may
perform or have others perform appropriate inspections of
the relevant KARL MAYER CHINA business premises as far as
the premises relate to Data Processing, either itself or
through suitable inspectors to be named in individual cases
who are obliged to maintain confidentiality. The inspections
are limited to the Data Processing and must be performed
without avoidable disturbances at KARL MAYER CHINA’s
premises. KARL MAYER CHINA may object to the selection of
the inspector for good cause (such as lack of reliability or a

7.3

competitive relationship with KARL MAYER CHINA or the
KARL MAYER Group). Except in the case of urgent, objectively
justified reasons, which are to be documented accordingly by
the Customer, inspections will be carried out at the businesspremises of KARL MAYER CHINA after reasonable advancenotice of at least one (1) month, during the normal businesshours of KARL MAYER CHINA, and at most every twelve (12)months. KARL MAYER CHINA may demand proper remuneration for assistance in carrying out an inspection. The expenditure of an inspection is generally limited to one (1) day per
calendar year for KARL MAYER CHINA. Same principles andrequirements shall apply to any other inspection which goesbeyond KARL Mayer China’s own premises if such inspection
is agreed upon by the Parties.
KARL MAYER CHINA shall provide the Customer with the­relevant and necessary information upon request and makethe relevant evidence available.

8.	Reports of infringements on the part of KARL MAYER
CHINA
8.1 KARL MAYER CHINA designs the data processing, its operational procedures and the associated processes, systems andinstallations in such a way that it can record, recognise andreport any Data Protection infringements.
8.2 KARL MAYER CHINA shall notify the Customer immediately
if (a) a security breach results in the accidental or unlawfuldestruction, loss, alteration or unauthorised disclosure of oraccess to Personal Customer Data and Delivery Data or (b)KARL MAYER CHINA, its employees or agents have breached
any data protection regulations or the obligations set out
herein which relate to Personal Customer Data and Delivery
Data.
9.	
9.1

9.2
9.3

Authority of the Customer to issue instructions
Data Processing shall be governed exclusively by (a) this Appendix 2, (b) possible instructions within the functionalities of
the Solutions and the Platform (such as login, change of user
name, change of password and logout, etc.) and support requests of the Customer as well as (c) any other instructionsof the Customer, each of which shall be documented in writing or in text form.
The Customer shall immediately confirm verbal instructionsin writing or text form.
KARL MAYER CHINA shall inform the Customer immediately
if it believes an instruction violates applicable data protection
law. KARL MAYER CHINA is entitled to suspend the executionof the relevant instruction until it is confirmed or amended by
the Customer.

10.	 Erasure of data and return of data carriers
10.1 Copies or duplicates of Personal Customer Data and Delivery
Data must not be made without the Customer’s knowledge.
This does not apply to backup copies, insofar as they are necessary to ensure proper Data Processing, as well as data thatare required to be compliant with statutory retention obligations.
10.2 After completion of the contractually agreed activities, or earlier on the Customer’s request – but at the latest on termination of the Main Contract – KARL MAYER CHINA shall returnto the Customer all documents, created processing and utilisation results, and data files that are connected with this Appendix 2, or destroy them in accordance with data protection
law after obtaining consent. The same applies to test andwaste material. The record of the erasure shall be submitted
to the Customer upon request.
Appendix 2 Annex 1
Technical and organisational measures
A. General
1.	Confidentiality
1.1 Physical access control
Measures that prevent unauthorised persons from accessing
Data Processing systems with which Personal Information
are processed or used:• The access protection (building) to the Contractor’s systems is secured by a locking system (key in connection withtransponder). A distinction is made between outdoor areas(buildings) and indoor areas. The individual zones are­subject to different security requirements.
• Access by visitors is organisationally regulated in detail
within the framework of the access concept. Visitors mustring the bell at the main entrance, sign in, and picked up
where applicable.
• Before entering the floor, the visitor must ring the bell again
and register once more.
• Visitors are accompanied by employees of the Contractor
for the duration of their visit.
• Emergency exits are only accessible from the inside.
• The issue of keys and the allocation of access authorisations
are regulated in an organisational guideline.
• The HR department of the Contractor is centrally responsible
for the administration of the keys.
1.2 System access control
Measures that prevent Data Processing systems from being
used by unauthorised persons:• User accounts are checked regularly, i.e. at least annually.
• User accounts are blocked promptly as part of the offboarding process.
• User accounts are password protected. All passwords must
be created and updated in accordance with the “KARL
MAYER Group IT User Policy”. This policy addresses aspects of complexity, handling, custody and record keeping.
• It is ensured that each employee of the Contractor has only
the rights they need for their activity (principle of minimal
rights).
• The principle of the tidy workplace applies.
1.3 Memory access control
Measures which ensure that those authorised to use a Data
Processing system can only access the data for which they
have access authorisation and that Personal Information­cannot be read, copied, modified or removed without authorisation during processing and use and after storage:
Access management for operating system and databasemanagement:• Access is regulated organisationally.
• Access to the operating system and applications is logged
on a personal basis.
• Access authorisations are only granted after approval by
the person responsible for information.
• A check is made before the permissions are assigned.
1.4 System measures• The Contractor uses up-to-date antivirus solutions and­carries out centralised and automatic pattern and software
updates.

page 15 / 18• Firewall systems are used as central security components
in various places at the Contractor’s place of business.
• Changes to the Client’s data shall be recorded.
• Remote access is via VPN and is encrypted and protected
via a second factor.
• Encrypted hard disks on local terminals.
• Software and security updates are carried out promptly as
part of the data centre maintenance.
• Access authorisations are only granted after written­approval by the supervisor.
• A check is made before permissions are given.
• Fire alarm system and UPS in the data centre and at­central infrastructure nodes.
2.	Integrity
2.1 Transfer control
The Contractor has implemented the requirements as­follows:• VPN connections with second factor.
• Special protection during physical transport of data storage
devices.
2.2 Input control• Traceability through personal log-in and activity logging
2.3 Separation control• The Contractor shall ensure that data collected for different
purposes can be processed separately.
• Separation of data by network separation (VLAN).
• Personal Information of the respective Clients are logicallyseparated from each other by assignment to the respective
user accounts.
2.4 Order control• Documentation of processing activities.
• Careful selection of sub-processors.
• No use of sub-processors without Client’s consent.
• Written agreement with the sub-processor on the minimum
data protection standard.
• Adequate monitoring of sub-processors.
• Ensuring the destruction or return of the data after completion of the order in compliance with data protection laws
and regulations.
3.	
3.1

3.2

4.	

• Appointment of a data protection officer and additional dataprotection coordinators at local sites.
B. Cloud services / data centres in which the Solutions
and the Platform are hosted (currently AWS Cloud service)
1.	

1.1

1.2

Availability and resilience
Availability Control• Patch management for servers and End Devices.
• Uninterruptible power supply (UPS)• Fire alarm system.
• Virus protection.
• Firewall.
• Backup and restore strategy.
Timely manner restorability• Service agreements with contracted service providers.
Procedures for periodic test, assessment and evaluation• Data protection management system• Incident response management.
• Regular documented mandatory training for all employees.
Additional, annual classroom training for staff in particularly sensitive areas.
• Documented employee commitment to data protection.
• Instruction on postal and telecommunications secrecy forthe relevant group of employees.
• Nondisclosure agreements (NDA) with partners and service
providers.
page 16 / 18

Information Security Programme
Amazon Web Services Inc. (“AWS”) maintains an information
security programme (including the establishment and enforcement of internal policies and procedures) designed to (a)help the Customer protect Personal Customer Data from­accidental or unlawful loss, access or disclosure, (b) identify
reasonably foreseeable and internal risks to security and­unauthorised access to the AWS Network, and (c) mitigate­security risks, including through risk assessment and periodic
testing. AWS will designate one or more employees to coordinate and be responsible for the information security programme. The information security programme will include
the following measures:
Network security
The AWS network is electronically accessible to employees,
contractors and all other persons necessary for the provisionof the AWS services. AWS maintains access controls and policies to govern what access to the AWS network is permitted
from each network connection and user, including the use of
firewalls or functionally equivalent technologies and authentication controls. AWS maintains remediation and incident­response plans to address potential security threats.
Physical security(a)	Physical access controls
The physical components of the AWS network are housed
in inconspicuous facilities (“Facilities”). Physical access
controls are used to prevent unauthorised access to Facilities at both perimeter and building entrances. Passage
through the physical barriers in the Facilities requires­either electronic access control (such as card access­systems, etc.) or validation by human security personnel(such as contracted or internal security guards, reception
staff, etc.). Photo IDs shall be assigned to employees andcontractors and shall be kept while employees and contractors are in the Facilities. Visitors must register withthe relevant staff, identify themselves, receive a visitor’s
badge to wear while in the Facilities, and be accompanied
by authorised staff or contractors at all times when visiting the Facilities.
(b)	Limited access for employees and contractors
AWS grants access to the Facilities to those employees
and contractors who have a legitimate business need forsuch access rights. If an employee or contractor no longer
needs the access rights assigned to him or her, the accessrights will be revoked immediately, even if the employee
or contractor continues to be an employee of AWS or its
affiliates.
(c) Physical safeguards
	All access points (with the exception of the main entrance
doors) are kept in a secured (locked) state. Access points
to the Facilities are monitored by CCTV cameras that­record all persons entering the Facilities. AWS also maintains electronic intrusion detection systems designed
to detect unauthorised access to the Facilities, including
monitoring of weak points (such as main entrance doors,emergency exit doors, roof hatches, loading dock doors,etc.) with door contacts, glass break devices, interior­ otion detectors or other devices designed to detectm­individuals attempting to gain access to the Facilities. All­physical access to the Facilities by staff and contractors islogged and regularly checked.
2.	

Ongoing assessment
AWS conducts regular reviews of the security of its AWS­­network and the adequacy of its information security programme, as measured against industry security standards
and its policies and procedures. AWS shall continuously­assess the security of its AWS network and related AWS­services to determine whether additional or different security
measures are needed to respond to new security risks or­findings from periodic reviews

page 17 / 18

Appendix 2 Annex 2
Authorised sub-processors
Sub-processors

Services

Seat and adequate level of dataprotection

KARL MAYER STOLL R&D GmbH,
Industriestr. 1, D-63179 Obertshausen

Software development in relation to the
Platform and the Solutions

Germany (EU)KM.ON GmbH,
Carl-Benz-Str. 21, D-60386 Frankfurt/Main

Provision, operation, support and­maintenance of the Solutions and the
Platform

Germany (EU)KM.ON Asia Ltd,
2907 Metroplaza Tower 2, 223 Hing Fung Road,
Kwai Chung, New Territories, Hong Kong

Provision, operation, support and­maintenance of the Solutions and the
PlatformHong Kong
EU standard contractual clauses

KARL MAYER (HK) Ltd,
2907 Metroplaza Tower 2, 223 Hing Fung Road,
Kwai Chung, New Territories, Hong Kong

Support activities related to Networked
Machines

Hong Kong
EU standard contractual clauses

Amazon Web Services Inc.,
Hosting of the Solutions and the Platform
410 Terry Ave. North, Seattle, WA 98109-5210, USAUSA
EU standard contractual clauses
Data centre Frankfurt/Main region

Auth0 Inc.,
10800 NE 8th St., Suite 700, Bellevue, WA 98004,
USA

Providing services for the authentication ofusers of the Solutions and the PlatformUSA
EU standard contractual clauses

Mayer Textile Machine Corp.,
310 North Chimney Rock Road, 27409 Greensboro,
North Carolina, USA

Support activities related to Networked
MachinesUSA
EU standard contractual clauses

NIPPON MAYER LTD,
27-33 Kamikitano 1 Chome, 918-8522 Fukui City,Japan

Support activities related to Networked
Machines

Japan
Adequacy decision, EU standard
contractual clauses

KARL MAYER STOLL INDIA PRIVATE LIMITED
103, Dimple Arcade, Asha Nagar, Kandivali
East400101 Mumbai, Maharashtra

Support activities related to Networked
MachinesIndia
EU standard contractual clauses

KARL MAYER STOLL Bangladesh Limited
House – G10A (NE), Road- 79 Gulshan – 02
Dhaka – 1212, Bangladesh

Support activities related to Networked
Machines

Bangladesh
EU standard contractual clauses

KARL MAYER (CHINA) LTD. . No. 518 Changwu South Road213167 Wujin District . Changzhou City . Jiangsu Province . China
www.karlmayer.com

page 18 / 18