Terms and conditions

Version 1.0 of 29 October 2026 · Annex 1: Data processing agreement

1. Scope

1.1 These general terms and conditions (“Terms”) apply to all contracts under which concilio et labore GmbH, Amselweg 4, 54306 Kordel, Germany, registered with the Amtsgericht Wittlich under HRB 46287 (“Operator”), provides the ifm.lu platform and related services to a customer (“Customer”).

1.2 The platform is offered exclusively to undertakings within the meaning of § 14 of the German Civil Code (BGB), in particular to UCITS management companies, alternative investment fund managers and other undertakings of the financial sector (“investment fund managers”, “IFM”). It is not offered to consumers.

1.3 The contract consists of, in this order of precedence: the order form signed by both parties (“Order Form”); the data processing agreement in Annex 1 to these Terms (“DPA”), published at ifm.lu/terms/dpa/; the service description and service levels attached to the Order Form; and these Terms. The DPA is part of these Terms and is concluded with the contract; it needs no separate signature. Terms and conditions of the Customer do not apply, even if the Operator does not object to them or performs without reservation.

2. Definitions

Platform means the software service ifm.lu with its portal at ifm.lu/portal/, its modules (registers, workflows, data hub, messenger, library and others) and its interfaces, in the version made available from time to time.

Standard Set means the policies, procedures, controls, catalogues of regulatory requirements, templates, settings and other content that the Operator provides on the Platform.

Customer Data means all data that the Customer or its users enter into or transmit to the Platform, or that the Platform generates for the Customer from them, including the Customer’s records, documents, messages and settings.

Users means the persons whom the Customer authorises to use the Platform: its staff, its conducting officers and board members, and, where the Customer so decides, its auditors, delegates or advisers.

Tenant means the separated environment of the Customer on the Platform.

3. Conclusion of the contract

3.1 Presentations of the Platform on ifm.lu, in documents or in demonstrations are not binding offers. The contract is concluded when both parties sign the Order Form, or when the Operator confirms in writing an order of the Customer.

3.2 The Order Form sets out in particular the modules, the number of sub-funds or other units of the licence, the fees, the start date, the initial term, the onboarding services and, where agreed, a pilot arrangement.

4. Services of the Operator

4.1 The Operator provides the Platform as a cloud service for the term of the contract, operates, maintains and further develops it, and gives the Customer access for the agreed number of units and Users. The functions of the Platform are described in the service description; the Operator informs the Customer of the state of each module.

4.2 The Platform runs in the cloud region Europe (Frankfurt) of Amazon Web Services. The Order Form states whether the Customer’s environment runs in cloud accounts that the Customer holds with the cloud provider, with the Operator operating the resources in them on the Customer’s behalf, or in cloud accounts of the Operator. The control plane (portal, user directory, release management) is run by the Operator. Customer Data are encrypted in transit and at rest; the content of messages and attachments with keys of the Customer’s Tenant.

4.3 The Operator provides the Standard Set as a starting point. The Customer adopts, changes or rejects each document and setting through its own approval processes; the Platform records these decisions.

4.4 Onboarding services (set-up of the Tenant, connection of delegates and data sources, import of existing data, training) are provided as agreed in the Order Form.

4.5 Support is provided by e-mail and through the portal on business days in Luxembourg, from 9:00 to 17:00 Central European Time. Service levels, including availability, response times, recovery objectives and maintenance windows, are set out in the service levels attached to the Order Form. Where no service levels are agreed, the Operator aims at an availability of the portal of 99.5 % per calendar month, excluding announced maintenance.

4.6 The Operator may change and further develop the Platform, provided that the agreed functions are not materially reduced. It announces material changes at least 30 days in advance through the portal, and changes that require action by the Customer, such as the adoption of a changed document, with an adequate period. Changes required by law, by a supervisory authority or for security may be made at shorter notice.

5. What the Platform is not

5.1 The Platform is a tool. It does not perform any regulated activity for the Customer, does not provide investment, legal, tax or regulatory advice, and does not replace the judgement of the Customer’s conducting officers, control functions and board. The Customer remains fully responsible for compliance with the laws and regulations that apply to it, for its decisions, for its filings with authorities and for its relations with investors, funds and delegates.

5.2 The Standard Set and the regulatory catalogues are prepared with care and kept up to date as described on the Platform. They are general in nature; the Operator does not guarantee that they are complete, correct or suitable for the particular situation of the Customer. Points marked as open in the documents are proposals still to be confirmed.

5.3 Functions that use artificial intelligence (for example the transcription of voice messages or the drafting agents) produce drafts and proposals only. A person of the Customer reviews and adopts every output before it is relied on. The Customer decides which AI functions it uses, records them in its register of AI use cases, for which the Platform provides standard entries, and can switch off by setting those it does not wish to use. Customer Data are not used to train models, neither by the Operator nor by its providers.

6. Obligations of the Customer

6.1 The Customer:

• gives access only to Users it has authorised, keeps their accounts up to date and removes access without delay when it ends;
• ensures that Users keep their sign-in credentials and second factors confidential and use the Platform in line with these Terms and its own policies;
• is responsible for the lawfulness of the Customer Data, in particular for having a legal basis for any personal data it enters;
• notifies the use of the Platform to the competent authority where required (for example under the rules on outsourcing and on ICT third-party risk), keeps its register of information, and includes the Platform in its own risk management and business continuity arrangements;
• reports without undue delay any suspected misuse of the Platform, security incident or defect it becomes aware of.

6.2 The Customer shall not, and shall not allow others to: use the Platform for unlawful purposes; attempt to access other Tenants, the infrastructure or the source code; test the security of the Platform without the Operator’s prior written consent; circumvent technical limits; or make the Platform available to third parties beyond the Users.

6.3 The Operator may suspend access of a User, or temporarily restrict the Platform, where there is a concrete risk to the security of the Platform or of other Tenants or a serious breach of these Terms. It informs the Customer without delay and limits the measure to what is necessary.

7. Fees and payment

7.1 The fees are set out in the Order Form. Unless agreed otherwise, the annual fee is invoiced yearly in advance, onboarding fees on the start date, and other services monthly in arrears. All fees are net of value added tax, which is added at the applicable rate.

7.2 Invoices are payable within 30 days of receipt without deduction. If the Customer is in default, the Operator may claim statutory default interest and, after a written reminder with a period of at least 14 days, suspend access to the Platform; read access needed by the Customer to meet its legal obligations and the export of Customer Data remain available.

7.3 The Operator may adjust the fees once per contract year with effect from the next contract year, by notice given at least three months in advance. If the increase exceeds five per cent, the Customer may terminate the contract with effect from the date the increase takes effect.

7.4 The Customer may set off only claims that are undisputed or have been finally established by a court.

8. Customer Data, confidentiality and professional secrecy

8.1 The Customer Data belong to the Customer. The Operator uses them solely to provide the services under the contract and as instructed by the Customer, and does not use them for its own purposes, including product development or statistics, except in aggregated form that allows no conclusion as to the Customer, the funds or any person.

8.2 Each party keeps confidential all information of the other party that is marked as confidential or is confidential by its nature, uses it only for the purposes of the contract and protects it at least as carefully as its own confidential information. This duty continues for five years after the end of the contract, and for trade secrets and Customer Data without limit. It does not apply to information that is or becomes public without breach, that the recipient already had or developed independently, or that must be disclosed by law or to an authority; in the last case the recipient informs the other party where permitted.

8.3 The Operator is aware that Customer Data may be subject to professional secrecy under the laws that apply to the Customer, in particular in Luxembourg. It keeps them secret accordingly, binds the persons who have access to them to secrecy in writing, gives them access only where needed for the services, and records any access by its staff to the Customer’s environment. The Customer remains responsible for assessing whether its professional secrecy rules permit the use of the Platform and of the providers listed in the DPA.

8.4 The Operator does not disclose Customer Data to authorities unless it is legally obliged to do so. It then informs the Customer in advance where permitted, and challenges requests that it considers unlawful.

9. Data protection

9.1 Where the Operator processes personal data on behalf of the Customer, it does so as processor under the DPA (Annex 1 to these Terms), which meets the requirements of Art. 28 of the General Data Protection Regulation (GDPR). The DPA lists the sub-processors, the locations of processing and the technical and organisational measures. The version of the DPA in force when the contract is concluded applies; clause 19 applies to changes.

9.2 The Operator informs the Customer at least 30 days in advance of any intended change of sub-processors. The Customer may object on reasonable grounds; if no solution is found, the Customer may terminate the affected services with effect from the change.

10. Security, incidents and continuity

10.1 The Operator maintains appropriate technical and organisational measures to protect the availability, authenticity, integrity and confidentiality of Customer Data, in particular encryption in transit and at rest, separation of Tenants, multi-factor authentication of Users, least-privilege access of its own staff, logging, backups and regular testing.

10.2 The Operator notifies the Customer without undue delay, and in any case within 24 hours of becoming aware, of any security incident or major disruption that affects or may affect the Customer’s Tenant or Customer Data. It provides the information the Customer needs to classify and report the incident to the competent authorities, and assists the Customer in handling it, at no extra cost where the incident lies in the Operator’s sphere and otherwise at the rates of the Order Form.

10.3 The Operator maintains and tests business continuity and recovery plans for the Platform and informs the Customer of the results relevant to it. It participates, as reasonably required, in the Customer’s ICT security awareness and digital operational resilience testing, including threat-led penetration testing, under conditions agreed in advance.

11. Audit, information and supervisory authorities

11.1 The Customer, its internal and external auditors, and the competent supervisory authorities of the Customer, in particular the Commission de Surveillance du Secteur Financier (CSSF), and persons appointed by them, have the right of access to, inspection and audit of the Operator’s premises, systems, documents and staff relevant to the services, and to receive copies of relevant documents. Audits by the Customer are announced at least 30 days in advance, except in an emergency, and carried out so as not to disrupt the operations of the Operator or the confidentiality of other customers; the Operator may propose pooled audits or equivalent certifications and reports, which do not limit the rights of the authorities.

11.2 The Operator cooperates fully with the competent authorities of the Customer and gives them the information they request.

11.3 The Operator informs the Customer without delay of any development that may materially affect its ability to provide the services, including changes in its ownership, insolvency proceedings and changes in sub-outsourcing of important parts of the services.

12. Subcontractors

12.1 The Operator may use subcontractors, in particular cloud infrastructure providers. It remains responsible for their performance as for its own, selects and monitors them with due care, and imposes on them obligations on security, confidentiality, audit and cooperation with authorities equivalent to those in these Terms.

12.2 Subcontractors that support material parts of the services are listed in the service description or the DPA. Clause 9.2 applies to changes.

13. Rights of use and intellectual property

13.1 For the term of the contract the Operator grants the Customer a non-exclusive, non-transferable right to use the Platform for its own business and that of the funds it manages, through its Users, within the units agreed.

13.2 The Customer may use, change and keep the documents of the Standard Set that it has adopted for its own organisation, also after the end of the contract, and may make them available to its auditors, supervisory and other competent authorities, courts and public bodies where required. Any other reproduction or disclosure to third parties requires the Operator’s prior written consent. All other rights in the Platform and the Standard Set remain with the Operator or its licensors.

13.3 Suggestions of the Customer for the development of the Platform may be used by the Operator freely, without any obligation and without disclosing Customer Data.

14. Warranty

14.1 The Operator warrants that the Platform has the functions agreed in the service description and is maintained in a condition fit for the agreed use during the term. The Customer reports defects in a comprehensible form. The Operator remedies defects within a reasonable period, at its option by correction, a workaround or a new version.

14.2 Strict liability for defects that existed when the contract was concluded (§ 536a(1), first alternative, BGB) is excluded. Claims for damages are subject to clause 15.

15. Liability

15.1 The Operator is liable without limitation for damage caused intentionally or by gross negligence, for injury to life, body or health, under a guarantee it has given, and under the German Product Liability Act.

15.2 In case of slight negligence, the Operator is liable only for the breach of an obligation whose fulfilment is essential for the proper performance of the contract and on whose fulfilment the Customer may regularly rely (cardinal obligation), and then only for the damage typical for the contract and foreseeable when it was concluded.

15.3 In the cases of clause 15.2, the liability of the Operator is limited per contract year to the fees paid by the Customer in the twelve months before the event causing the damage, and for the loss of data to the effort needed to restore them from regular backups.

15.4 The Operator is not liable for decisions of the Customer, for the content of documents, filings or communications that the Customer has adopted, or for fines imposed on the Customer, except where they result from a breach by the Operator for which it is liable under clauses 15.1 or 15.2.

15.5 The limitations of this clause also apply to the personal liability of the Operator’s staff, representatives and subcontractors.

16. Term and termination

16.1 The contract starts on the date set in the Order Form and runs for the initial term agreed there, by default twelve months. It is then extended by twelve months at a time unless terminated with three months’ notice to the end of the term.

16.2 Either party may terminate the contract for good cause without notice. Good cause for the Customer includes in particular:

• a serious breach by the Operator of applicable laws, regulations or contractual terms;
• circumstances identified in the Customer’s monitoring of ICT third-party risk that are deemed capable of altering the performance of the services;
• weaknesses in the Operator’s overall ICT risk management, in particular in the way it ensures the availability, authenticity, integrity and confidentiality of data;
• a request of a competent authority, or circumstances under which the authority can no longer effectively supervise the Customer as a result of the contract.

16.3 Good cause for the Operator includes in particular a default of payment of more than two months’ fees after a written reminder, and a serious breach of clause 6.2.

16.4 Notices of termination must be given in writing; e-mail with a signed document attached suffices.

17. Exit and return of data

17.1 During the contract the Customer can use the exports available on the Platform at any time. On request, the Operator provides within 30 days a complete export of the Customer Data in common machine-readable formats (for example CSV, JSON and Markdown) together with the documents and attachments stored, at no extra cost once per contract year and on the end of the contract.

17.2 On the end of the contract, for whatever reason, the Operator gives the Customer a transition period of up to six months on request, during which it continues to provide the services at the agreed fees and supports the transfer to the Customer or to another provider at the rates of the Order Form. This also applies in case of insolvency, resolution or discontinuation of the Operator’s business, as far as legally possible. Where the Customer’s environment runs in cloud accounts that the Customer holds (clause 4.2), the Customer keeps these accounts and the data in them.

17.3 After the transition period, or 90 days after the end of the contract if no transition is requested, the Operator deletes the Customer Data in its systems, including backups at the end of their rotation, unless a longer retention is required by law, and confirms the deletion in writing.

18. Force majeure

Neither party is liable for failures caused by events beyond its reasonable control, such as natural disasters, war, terrorism, pandemics, strikes not limited to the party, or official orders, provided it informs the other party without delay and takes reasonable steps to limit the consequences. Clause 10.3 remains unaffected. If such an event lasts longer than 60 days, either party may terminate the affected services.

19. Changes to these Terms

The Operator may change these Terms with effect for the future where this is necessary because of changes in law, in supervisory requirements or in case law, or for the further development of the Platform, provided that the balance of the contract is not shifted to the detriment of the Customer. It notifies the changes in writing at least two months before they take effect. The Customer may object within this period; if it does not, the changes are deemed accepted, and the Operator points this out in the notification. If the Customer objects, the previous Terms continue to apply, and either party may terminate the contract with effect from the date the changes would have taken effect.

20. Final provisions

20.1 The contract is governed by the law of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods. Mandatory provisions of the law applicable to the Customer as a supervised entity remain unaffected.

20.2 The exclusive place of jurisdiction for all disputes arising from or in connection with the contract is Trier, Germany. The Operator may also bring proceedings at the Customer’s registered office.

20.3 Changes and additions to the contract must be made in text form; this also applies to the waiver of this form requirement.

20.4 The Customer may assign rights under the contract only with the Operator’s consent, which shall not be withheld unreasonably for an assignment within the Customer’s group or to a successor managing the same funds.

20.5 Should any provision of the contract be or become invalid, the validity of the remaining provisions is not affected.

Contact: concilio et labore GmbH, Amselweg 4, 54306 Kordel, Germany · e-mail@cetl.lu