Version: 29 September 2026
1. Scope and contracting parties
(1) These terms apply to all contracts between MFM Datenschutz-Consulting GmbH, Kaiser-Friedrich-Promenade 6, 61348 Bad Homburg v.d.H. (the „Contractor“) and its clients covering consulting, training, audit and support services in data protection and IT compliance, including acting as an external data protection officer.
(2) The services are directed exclusively at entrepreneurs within the meaning of section 14 of the German Civil Code (BGB), at legal entities under public law and at special funds under public law. No contracts are concluded with consumers.
(3) Deviating or supplementary terms of the client do not become part of the contract, even if the Contractor does not expressly object to them or performs with knowledge of them. Deviations apply only if the Contractor agrees to them in text form.
2. Conclusion of contract
(1) Offers are non-binding unless expressly marked as binding. Prices shown on this website are non-binding guide values and do not constitute an offer in the legal sense.
(2) The contract is concluded by the Contractor's order confirmation or by the start of performance. Text form pursuant to section 126b BGB is sufficient for declarations made in the course of concluding the contract.
3. Subject matter of the services
(1) The type and scope of the services follow from the offer, the order confirmation or a separate specification. Descriptions on this website outline the range of services but do not in themselves create an obligation to perform.
(2) The Contractor owes an activity under the rules on service contracts (section 611 BGB), not a specific result. A specific result is owed only where expressly agreed.
(3) Data protection compliance is an ongoing task and depends on circumstances outside the Contractor's control, such as system changes at the client, the conduct of third parties and legal developments. The Contractor therefore promises neither a particular assessment by a supervisory authority nor freedom from regulatory measures.
(4) Reports, assessments and opinions relate to the information available at the time of the review. Later changes are not covered by a report.
(5) Where the website describes a service as “legally sound” or an assessment as “binding”, this means: the Contractor aligns the service with the state of legislation, case law and supervisory practice at the time of performance, and the assessment is its final evaluation based on the facts provided by the client. It does not bind authorities or courts; paragraph 3 remains unaffected.
4. Delimitation from legal advice
(1) The Contractor advises on data protection organisation and on technical and organisational implementation. Legal advice in individual cases is not part of the contract, to the extent that it goes beyond what is permissible as an ancillary service under section 5 of the German Legal Services Act (RDG).
(2) This does not affect the tasks of a data protection officer under Article 39 GDPR. Where legal representation or assessment beyond that is required, the Contractor will introduce its cooperation partner on request. In that case the engagement is entered into directly between the client and the law firm.
5. Duties of the client to cooperate
(1) The client provides the Contractor, in good time, in full and free of charge, with all information, documents and access required to perform the services, in particular details of processing activities, systems in use, service providers and data flows.
(2) The client names a responsible contact person with sufficient authority to decide and notifies changes without delay. It informs the Contractor without undue delay of events relevant to data protection, in particular of possible personal data breaches and of enquiries from supervisory authorities.
(3) Controllership within the meaning of Article 4 (7) GDPR remains with the client. It decides on the purposes and means of processing itself. Recommendations by the Contractor do not release it from that responsibility.
(4) If performance is delayed because cooperation is not forthcoming, agreed dates shift accordingly. Additional effort arising from this is charged at the agreed hourly rate.
(5) Deadlines that depend on the client's knowledge, in particular notifying a personal data breach within 72 hours under Article 33 GDPR, can be met by the Contractor only if the client informs it without undue delay under paragraph 2 and provides the necessary details.
6. Fees, expenses and payment
(1) The agreed fee applies, depending on the service as a monthly flat rate, a fixed price or on a time and materials basis. All prices are net and exclusive of statutory value added tax.
(2) Services beyond the agreed scope require a separate agreement and are charged on a time basis unless agreed otherwise. Time is billed in quarter-hour units.
(3) Travel time and travel costs for appointments are charged according to effort unless agreed otherwise.
(4) Invoices are payable within 14 days of receipt without deduction. Sections 286 and 288 BGB apply to the consequences of late payment.
(5) If the client is substantially in arrears with a payment due, the Contractor may suspend further performance after prior notice in text form until payment is made.
7. Term and termination
(1) Contracts for the external data protection officer service and other ongoing services with a monthly flat rate are concluded for an indefinite period, without a minimum term. Either party may terminate them with three months' notice to the end of a calendar month. By way of exception, use of the data protection seal runs for one year from the audit date and renews for a further year unless terminated with three months' notice to the end of the respective term; this also applies where payment is monthly. Text form, for example an email, suffices for any termination.
(2) The right to terminate for good cause remains unaffected for both parties. Good cause exists for the Contractor in particular if the client fails to meet its duties to cooperate despite a deadline, or requires it to take part in processing that is manifestly unlawful.
(3) Special rules apply to the appointment as data protection officer. Dismissal is governed by Article 38 (3) GDPR; dismissal or disadvantage for performing the tasks is not permitted. On termination the client cooperates in the dismissal and in notifying the change to the supervisory authority, and appoints a successor in good time where an obligation to appoint exists.
(4) After the contract ends the Contractor returns or deletes documents provided to it. The client chooses between return and deletion, unless a statutory retention obligation applies. The Contractor may retain a copy solely to meet its own statutory duties of proof and retention; it is deleted once the relevant period has expired.
8. Confidentiality
(1) Both parties treat as confidential all information that becomes accessible to them through the cooperation and that is not in the public domain. The obligation continues beyond the end of the contract.
(2) Excluded is information that was demonstrably already known, that becomes generally known without breach of this agreement, or whose disclosure is required by law or by a public authority.
(3) The duty of secrecy under Article 38 (5) GDPR applies in addition to work as a data protection officer.
9. Data protection and processing on behalf
(1) Where the Contractor processes personal data on behalf of the client as part of a service, the parties conclude an agreement under Article 28 GDPR before processing begins.
(2) Performing the statutory tasks of a data protection officer under Article 39 GDPR is not processing on behalf. The data protection officer acts free of instructions under Article 38 (3) GDPR and is in that respect neither a processor nor a controller. Paragraph 1 remains unaffected.
(3) The Contractor implements appropriate technical and organisational measures under Article 32 GDPR. They are described in the agreement under Article 28 GDPR and evidenced on request. Engaging further processors is governed by Article 28 (2) GDPR. Processing in a third country takes place only where the conditions of Chapter V GDPR are met.
(4) The Contractor assists the client with data subject requests within the scope of Article 28 (3) (e) GDPR.
10. Work results and rights of use
(1) On full payment the client receives a simple right, unlimited in time and territory, to use the reports, concepts, policies and templates created for it for its own purposes within its own company and affiliated companies.
(2) Passing them to third parties, publishing them or using them for advertising requires the Contractor's prior consent in text form. Extracts must not be used in a way that distorts their meaning.
(3) Methods, review frameworks, templates and general know-how that the Contractor uses or develops in the course of its work remain fully available to it.
(4) The data protection seal may be used only for the audited site, only unaltered and only for the period of validity. If the conditions cease to apply, use must stop immediately.
11. Liability
(1) The Contractor is liable without limitation in cases of intent and gross negligence, for injury to life, body or health, for fraudulent concealment of a defect, to the extent of a guarantee given, and under the German Product Liability Act.
(2) In the case of slightly negligent breach of a material contractual duty, liability is limited to the foreseeable damage typical for this type of contract at the time the contract was concluded. A duty is material if its fulfilment is what makes proper performance of the contract possible in the first place and on whose observance the client may regularly rely.
(3) Liability for slight negligence is otherwise excluded.
(4) Liability under paragraph 2 is limited per event of damage to the net fee agreed for the contract year concerned, but at most to the sum insured under the existing professional indemnity insurance.
(5) The above limitations also apply in favour of the Contractor's employees, legal representatives and vicarious agents.
12. Use of third parties
(1) The Contractor may engage qualified third parties to perform its obligations, in particular its cooperating law firm for legal services. It remains the client's contracting party and obliges any third parties engaged to maintain confidentiality. Where third parties act as independent contracting parties of the client, the Contractor points this out beforehand.
(2) Where personal data is processed on behalf of the client in doing so, Article 28 (2) GDPR applies. A further processor is engaged only with the client's authorisation. The confidentiality undertaking in paragraph 1 does not replace that authorisation.
13. Force majeure
Events beyond a party's control that make performance significantly more difficult or impossible release that party from its obligation to perform for their duration. These include natural events, industrial action, official orders and large-scale failures of power or telecommunications networks. The affected party informs the other without delay. If the impediment lasts longer than three months, either party may terminate the affected part of the contract.
14. Final provisions
(1) Amendments and additions to the contract require text form. This also applies to any waiver of this form requirement.
(2) The client may set off only against undisputed claims or claims established by a final court decision. It has a right of retention only for claims arising from the same contractual relationship.
(3) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods.
(4) The exclusive place of jurisdiction for all disputes arising from or in connection with the contractual relationship is the Contractor's registered office, provided the client is a merchant, a legal entity under public law or a special fund under public law. The Contractor may also sue the client at the client's general place of jurisdiction.
(5) As no contracts are concluded with consumers under clause 1 (2), the Contractor is neither willing nor obliged to take part in dispute resolution proceedings before a consumer arbitration board (section 36 VSBG).
(6) Should any provision of these terms be or become invalid, the validity of the remaining provisions is unaffected. The statutory provision takes the place of the invalid one.
(7) This English text is a translation for convenience. In case of discrepancy the German version prevails.
Responsible party and address: see imprint. Questions about these terms are answered at info@datenschutzfrankfurt.de.