Terms of Service

1.1 The platform is offered exclusively to businesses, in particular banks and other regulated financial institutions, within the meaning of Section 14 BGB. It is not offered to consumers.

1.2 These terms, together with the order form and the data processing agreement [DPA DOCUMENT REFERENCE], form the contract. Customer terms of purchase do not apply, even if the Provider performs without expressly objecting to them.

1.3 Individual agreements in the order form take precedence over these terms.

2.1 exfin is a research and evidence platform. It monitors and retrieves public sources, extracts and verifies developments about organizations, countries, and, on the Customer's instruction, natural persons in their professional capacity; it mirrors facts published by official company registers and gazettes; and it assembles the results into research views, screenings, structured reference data, and exportable reports. Every substantive output carries a citation to its source, including register name, identifier, and retrieval date for register facts.

2.2 The platform is an information tool. It prepares cited evidence and draft assessments; it takes no decision and executes no action. Screening verdicts, relevance scores for deals, and similar outputs are drafts that a User must review and confirm or dismiss before any use.

2.3 The platform is not: a credit agency or credit-scoring service, a sanctions-list or PEP screening service (the Customer's licensed tools own those; the platform checks no such list), a source of legal advice, or a substitute for the Customer's own regulatory judgment.

2.4 Parts of the platform use artificial intelligence to extract, match, link, and summarize sourced facts. AI-drafted content is labeled in the product. The Provider maintains a self-assessment under Regulation (EU) 2024/1689 (AI Act) and makes it available to the Customer on request.

2.5 The Provider may develop the platform further (including changing or retiring individual features) provided the core service described in the order form is not materially reduced.

3.1 The Provider provisions the Customer's workspace and initial administrator accounts. The Customer manages its Users and ensures that access credentials are kept confidential and used only by the individual they were issued to.

3.2 The Customer informs the Provider without undue delay if credentials are compromised or a User leaves. The Provider may suspend accounts that present a security risk.

3.3 Roles and permissions in the product (for example analyst, viewer, administrator) are part of the service; the Customer assigns them so that Users only act within their function.

The Customer and its Users must not:

• (a) use platform output as the sole basis for an automated decision that produces legal or similarly significant effects on a natural person (Art. 22 GDPR); a human being must review and own every such decision;
• (b) use the platform to evaluate the creditworthiness of natural persons, to establish a credit score of a natural person, or to build any person score, rating, or ranking from platform output;
• (c) use person screening for anything other than anti-money-laundering customer due diligence and enhanced due diligence in the Customer's regulated business; employment screening, tenant screening, consumer-eligibility decisions, marketing, and law-enforcement uses are prohibited;
• (d) state an untrue purpose when instructing a person screening; the purpose recorded with each request must be the real one;
• (e) resell, sublicense, redistribute, or systematically extract platform content, in particular data from licensed sources; where the product renders a source in reduced form (for example citation-only), the Customer must not reconstruct or extract the underlying licensed data;
• (f) republish register-derived personal data outside the Customer's own due-diligence work product, or operate any public-facing search over platform data;
• (g) circumvent technical limits of the platform (rate limits, tenant isolation, render policies), probe or scan the infrastructure, or introduce malicious code;
• (h) share access with third parties other than Users, or use the platform on behalf of entities that are not party to the contract;
• (i) use the platform or its output as a safety component of any product.

The Provider may suspend access on reasonable suspicion of a material violation of this section, after notice to the Customer where the delay does not create risk, and will restore access when the violation is resolved.

5.1 The Customer is responsible for the legal basis of the checks it instructs. In particular, where the Customer instructs research or screening on a natural person, the Customer confirms that it acts within its own regulatory duties (for example customer due diligence under the GwG and the EU anti-money-laundering framework) and that its recorded purpose is accurate. The Provider relies on this confirmation.

5.2 The Customer ensures that its Users review draft outputs before use, consistent with the human-oversight design of the platform.

5.3 The Customer provides the cooperation reasonably needed for service delivery (for example naming technical and compliance contacts).

6.1 Where the platform processes personal data on the Customer's instruction (in particular bank-instructed screenings of named subjects), the Customer is the controller and the Provider the processor; the data processing agreement [DPA DOCUMENT REFERENCE] governs.

6.2 For the platform's own layers, in particular the mirror of public registers and gazettes, the Provider is the controller; the published Privacy Policy and Public Records Notice govern. The Provider warrants toward the Customer that this layer processes only register-published facts with citations and computes no person-level scores.

6.3 Each party complies with the data protection law applicable to it.

7.1 Each party protects the other party's confidential information with the care it applies to its own comparable information, at least with reasonable care, and uses it only for performing the contract.

7.2 The Customer's research activity in the platform (what it searches, screens, and assembles) is the Customer's confidential information. The Provider's non-public product architecture, documentation, and pricing are the Provider's confidential information.

7.3 Statutory disclosure duties remain unaffected; the disclosing party is informed before disclosure where legally permitted.

8.1 The platform, its software, design, and documentation remain the Provider's property. The Customer receives a non-exclusive, non-transferable right, limited to the contract term, to use the platform for its internal business purposes.

8.2 Reports and exports generated by the Customer may be used and retained by the Customer for its internal purposes, including regulatory files and audits, beyond the contract term. Facts published by public registers are not claimed by either party.

8.3 The Customer grants the Provider the non-exclusive right to process Customer-provided inputs to the extent needed to deliver the service.

9.1 The Provider operates the platform with reasonable care and skill and targets high availability, but does not warrant uninterrupted availability. Planned maintenance is announced in advance where feasible.

9.2 Any binding service levels and support commitments are those stated in the order form [SLA REFERENCE, IF AGREED].

10.1 The platform reproduces information from public sources and official registers as of the time of retrieval, with the retrieval date cited. Registers and public sources remain the authoritative record. The Provider does not warrant that source content is accurate, complete, or current beyond faithful reproduction of what the cited source stated at retrieval.

10.2 Search-based screenings reflect what the queried public sources returned within the configured scope, window, and budget at the time of the run; results marked incomplete are incomplete. An empty result means that the configured search found nothing, not that nothing exists.

10.3 Platform output is information, not advice. It does not constitute legal, compliance, or investment advice, and it does not replace the Customer's own regulatory assessment.

10.4 For material register facts intended to carry legal consequences, the Customer should verify at the cited source; the platform is built to make exactly that verification a single click.

11.1 The Provider is liable without limitation: for intent and gross negligence; for injury to life, body, or health; under the German Product Liability Act; and within the scope of any guarantee the Provider has expressly assumed in writing.

11.2 For simple negligence, the Provider is liable only for the breach of essential contractual obligations (obligations whose fulfillment makes proper performance of the contract possible in the first place and on whose fulfillment the Customer regularly relies), and limited to the damage typical for this type of contract and foreseeable at conclusion.

11.3 In the cases of clause 11.2, the Provider's total liability per contract year is capped at the fees the Customer paid for the platform in the twelve months preceding the event giving rise to the claim.

11.4 In the cases of clause 11.2, liability for loss of data is limited to the restoration effort that would have been necessary had the Customer performed regular, risk-appropriate backups of data exported from the platform.

11.5 Any further liability of the Provider is excluded. The limitations above also apply in favor of the Provider's employees and agents. Liability under mandatory statutory provisions remains unaffected.

11.6 The Customer remains solely responsible for decisions it takes; the allocation of roles in clauses 2.2, 4(a), and 5.1 is also an allocation of responsibility.

12.1 Term, renewal, and ordinary notice periods are stated in the order form [ORDER FORM REFERENCE].

12.2 Termination for cause under Section 314 BGB remains unaffected. For the Provider, cause includes a persistent, material violation of section 4 (acceptable use) that the Customer does not cure after notice.

12.3 After the end of the contract, the Customer may export its reports and data for a wind-down period of 30 days; thereafter the Provider deletes Customer data in accordance with the data processing agreement, except where statutory retention duties or the append-only audit design (identifiers only) require otherwise.

13.1 The Provider may amend these terms with effect for the future by notifying the Customer in text form at least six weeks before the amended terms take effect, highlighting the changes.

13.2 If the Customer does not object in text form before the effective date, the amended terms apply; the notification states this consequence expressly. If the Customer objects, each party may terminate the contract with one month's notice to the end of a calendar month; until then, and for the remaining term if no termination is declared, the previous terms continue to apply to the objecting Customer.

13.3 Changes that materially alter the contractual balance to the Customer's disadvantage require the Customer's express consent.

14.1 German law applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

14.2 To the extent a venue agreement is permitted by law (Section 38 ZPO), the exclusive venue for all disputes arising from or in connection with the contract is Potsdam, the court district of the Provider's seat in Kleinmachnow, provided the Customer is a merchant, a legal person under public law, or a special fund under public law.

14.3 The contract language is English. Where a German translation is provided, the English version prevails unless mandatory law requires otherwise.

14.4 Should individual provisions of these terms be or become invalid, the validity of the remaining provisions remains unaffected.

14.5 The Provider may name the Customer as a reference only with the Customer's prior consent in text form.