Terms of Service

1. Who we are and what these Terms cover

1.1 Provider. The rep4eu service is provided by:

In these Terms, "we", "us" and "our" mean Cloudkasten GmbH. "You" and "your" mean the company or other business that orders the Service. "rep4eu" is the brand under which we provide the Service.

1.2 Scope. These Terms apply to:

• the EU Representative subscription in the Essential and Business plans (the "Service");
• Enterprise engagements, unless and to the extent an individually signed Enterprise agreement provides otherwise; and
• your use of the rep4.eu website, the customer portal (the "Portal"), the free risk assessment and the free resources we publish (Section 13).

1.3 Business customers only. We offer the Service exclusively to companies, other legal entities and self-employed persons acting in the course of their trade, business or profession (entrepreneurs within the meaning of Section 14 of the German Civil Code, BGB). By ordering, you confirm that you are acting in that capacity. Consumer protection rules, including the statutory right of withdrawal for distance contracts, do not apply.

1.4 Your own terms. Your general terms and conditions or purchasing terms do not form part of the contract, even if we do not expressly object to them and even if we perform the Service without reservation.

1.5 Order of precedence. If documents conflict, the following order applies: (a) an individually signed agreement between you and us, (b) these Terms, (c) the Designation Letter, (d) other content on our website. The Designation Letter evidences the designation and its dates; it does not extend the Service beyond these Terms.

2. The Service

2.1 Designation. Once your company has been verified (Section 4), we accept, in writing, your designation of Cloudkasten GmbH as your representative in the European Union pursuant to Article 27 of Regulation (EU) 2016/679 (GDPR) for the Term. We are established in Germany. A single designation covers your Article 27 obligations towards supervisory authorities and data subjects in every EU member state and in the EEA states in which the GDPR applies.

2.2 Designation Letter. We issue a designation letter in PDF form (the "Designation Letter") which:

• names you as controller or processor, with your registered office and registration number, and names us as your representative with our address in Germany;
• states the effective date and the expiry date of the current Term;
• sets out the scope of our role and your obligations, consistent with these Terms;
• contains your dedicated forwarding address in the form yourcompany@rep4.eu (the "Forwarding Address"); and
• includes ready-to-use wording for your privacy notice in English and German.

The Designation Letter constitutes the written mandate required by Article 27(4) GDPR. We re-issue it in line with your plan: annually at each renewal on Essential, every six months on Business and quarterly on Enterprise. We also issue a new version whenever you change your company details in the Portal. Every version is stored and remains available to you (Section 9.4).

2.3 Point of contact. During the Term we act, in addition to you, as the point of contact in the EU for supervisory authorities and data subjects on all matters relating to your processing of personal data, as described in Article 27(4) GDPR. The channels for this are the Forwarding Address and our postal address in Erftstadt.

2.4 Forwarding. We forward every communication received at the Forwarding Address or by post for you to the GDPR contact you have named, including attachments, without undue delay. Emails are forwarded automatically, typically within minutes and at the latest on the next business day. Postal mail is scanned and forwarded within three business days of receipt. Each forwarded communication is recorded, with sender, subject and time, in the communications log in your Portal.

2.5 Authority contacts. If a supervisory authority contacts us in our capacity as your representative, we will inform you promptly, forward the request in full, confirm to the authority that we are your designated representative, and coordinate the next steps with you. On your written instructions we will relay your response to the authority. We do not answer on the merits, make commitments or take decisions on your behalf without your instructions. Legal assessment and drafting are covered by Section 3.2.

2.6 Record of processing activities. On request, we keep on file the record of processing activities under Article 30 GDPR that you provide to us, and we make it available to a supervisory authority that requests it, as Article 30(4) GDPR requires of a representative. We do not review, verify or draft the record unless this has been separately agreed.

2.7 Email support. We answer your questions about the designation, the Designation Letter, the privacy-notice wording and the handling of forwarded communications by email. Our response targets are 72 hours on Essential and 48 hours on Business, in each case measured in business days (Section 8.5). Enterprise customers receive the support agreed in their Enterprise agreement.

2.8 Portal. The Portal shows your subscription status, gives access to your invoices via the Stripe customer portal, holds every version of your Designation Letter, lets you update your company details, shows the communications log and lets you request an export or deletion of your account data. Each subscription comes with one user login.

3. What the Service does not include

3.1 No transfer of responsibility. Under Article 27(5) GDPR, designating a representative is without prejudice to legal actions that could be initiated against you. You remain the controller or processor. Responsibility, accountability and liability for your compliance with the GDPR remain entirely with you. Appointing us does not by itself make you GDPR compliant, and we make no representation that it does.

3.2 No legal advice within the subscription. German attorneys (Rechtsanwälte) are involved in running rep4eu, and they shape how we handle authority matters. Your contract, however, is with Cloudkasten GmbH, and the subscription does not create an attorney-client relationship with any lawyer. The following are not included in the subscription fee: legal advice, legal risk assessments, drafting substantive responses to authorities or data subjects, representation in administrative or court proceedings, data protection officer services, and drafting or reviewing privacy notices, records of processing activities or other compliance documents. These services are available under a separate engagement with the attorneys, or under an Enterprise agreement, at separately agreed fees. We will tell you when a request goes beyond the subscription and, if you wish, put you in touch.

3.3 Other representative regimes. The Service covers Article 27 GDPR only. Representative requirements under other laws, for example the UK GDPR, the Swiss Federal Act on Data Protection, the Digital Services Act or the EU AI Act, are not included unless expressly agreed in writing.

3.4 No assessment of your obligation. We do not assess whether you are required to designate a representative or whether your processing is lawful. The free assessment on our website is informational (Section 13). Whether to appoint a representative is your decision.

3.5 No general agent or mail service. Beyond what Article 27 GDPR requires, we are not your registered agent, agent for service of process, registered office or general mail-handling service. Communications that do not relate to data protection may be forwarded, returned to sender or disregarded at our reasonable discretion, and we will let you know when that happens.

4. Eligibility, onboarding and verification

4.1 Your confirmations. By ordering the Service, you confirm that:

• you are a controller or processor that is not established in the European Union and that falls, or may fall, within the scope of Article 3(2) GDPR;
• your EU-facing activities include data subjects in Germany, or you have otherwise satisfied yourself that a representative established in Germany meets Article 27(3) GDPR for your processing;
• to your knowledge, your processing of personal data is not unlawful; and
• neither you nor your beneficial owners are subject to sanctions or embargoes that would prohibit us from dealing with you.

4.2 Onboarding. After checkout you complete the onboarding form with your legal company name, registered address, registration number, the email address of your GDPR contact and a summary of your processing activities. You are responsible for this information being accurate and complete. The Designation Letter is generated from it.

4.3 Verification. Before we accept the designation, we verify that your company exists and that the details you provided match public records. Verification is automated where possible, using commercial business registers, and otherwise manual on the basis of incorporation documents you upload in the Portal. Automated verification is typically completed within 24 hours and manual review within 48 hours, in each case in business days. We may request further documents or information. We may repeat verification at renewal or after a material change to your details.

4.4 Effective date. We accept the designation and issue the Designation Letter only after successful verification. Once accepted, the designation applies with effect from the subscription start date stated in the Designation Letter, which is the date on which your first payment for the Term was confirmed. Until the Designation Letter has been issued, we are not your representative and you must not name us as such.

4.5 Declined designation. If verification is unsuccessful, we will contact you to resolve it. We may decline to accept the designation, or to renew it, if we cannot verify your company, if the information you provided is inaccurate, if your processing appears to be unlawful or to expose us to liability we cannot reasonably accept, or if legal, regulatory or professional reasons prevent us from acting for you. If we decline, the contract ends and we refund the subscription fee you paid for the current Term in full, unless the failure results from false or misleading information you provided or a refund is prohibited by law.

5. Your obligations

5.1 Publish our details. Within 14 days of receiving the Designation Letter, you will name us as your Article 27 representative in your privacy notice and on your EU-facing pages, using the wording in the Designation Letter or equivalent wording, and send us the link. You will keep this information published for the whole Term and remove it within 14 days after the designation ends.

5.2 Keep your details current. You will keep your company details in the Portal up to date and notify us promptly of any material change, including changes to your legal name, registered address, registration, GDPR contact, processing activities or EU-facing services, the establishment of an entity in the EU, a merger, insolvency or change of control, and any investigation, complaint or enforcement action by a supervisory authority that you become aware of.

5.3 Respond to forwarded communications. You will deal with every communication we forward to you and respond directly to data subjects and authorities within the statutory deadlines, which for data subject requests is generally one month under Article 12(3) GDPR. If you would like us to relay a response to an authority, you will give us clear written instructions. We are not responsible for the content, timeliness or outcome of your responses.

5.4 Stay reachable. You will monitor the GDPR contact mailbox you named, make sure it accepts email from our forwarding domain, and tell us immediately if it changes or becomes unavailable.

5.5 Cooperate. You will give us the information and instructions we reasonably request to respond to a supervisory authority, and, if you ask us to hold your record of processing activities, keep it accurate and send us updated versions.

5.6 Use our name correctly. You may name us as your Article 27 representative in privacy notices, contracts and compliance documents in the form provided in the Designation Letter. You will not state or imply that we have audited, certified or endorsed your compliance, and you will not use our name or logo for any other purpose without our written consent.

5.7 Account security. You will keep your Portal login credentials confidential, are responsible for all activity under your account, and will tell us immediately if you suspect unauthorised use.

5.8 Lawful use. You will not use the Service to mislead supervisory authorities or data subjects, in connection with unlawful processing, or to circumvent the GDPR.

6. Fees, taxes and payment

6.1 Fees. The subscription fee for your plan is the amount shown at checkout at the time of ordering, in the currency you selected there. Fees are payable annually in advance for the full Term. Enterprise fees are set out in your quote or Enterprise agreement. There are no setup fees.

6.2 Payment. Payment is processed by Stripe using the payment methods offered at checkout. By subscribing, you authorise us to charge your payment method for the fee of each renewal Term on or shortly after the renewal date. Invoices are available in the Stripe customer portal, which you can open from your Portal.

6.3 Taxes. Fees do not include value added tax or other applicable taxes unless stated otherwise at checkout. Where VAT is chargeable, it is shown at checkout and on your invoice. Business customers established in another EU member state with a valid VAT identification number are invoiced under the reverse-charge mechanism. If you are required by law to withhold taxes from a payment, you will increase the payment so that we receive the full fee.

6.4 Price changes. We may change the fee for the next Term by notifying you by email at least two (2) months before the renewal date. If you do not agree with the new fee, you may cancel under Section 7.1. The current Term is never affected.

6.5 Failed payments. If a renewal payment fails, we will notify you and give you 14 days to update your payment method. If payment is still outstanding after that period, we may terminate the contract with effect from the later of the end of the paid Term and the end of the 14-day period, and the designation ends on that date.

6.6 No refunds. Fees are non-refundable and no credit is given for unused parts of a Term, except where these Terms expressly provide otherwise (Sections 4.5, 7.4, 12.2 and 14.3) or where mandatory law requires a refund.

6.7 Plan changes. You can upgrade at any time; the upgrade takes effect at the next renewal unless we agree otherwise. Downgrades take effect at the next renewal.

6.8 Discounts. Discounts for start-ups, non-profits and multi-entity groups are agreed individually and apply only as confirmed by us in writing.

7. Term, renewal, cancellation and termination

7.1 Term, renewal and cancellation. The initial term is twelve (12) months from the effective date of designation. The agreement renews automatically for successive twelve-month terms unless cancelled with at least one (1) month's notice before the end of the current term. Cancellation takes effect at the end of the current term, and representation continues until that date. Fees already paid are not refunded on a pro rata basis.

The effective date of designation is the subscription start date (Section 4.4). The Designation Letter states the effective date and the expiry date of the current Term.

7.2 Giving notice. You can give notice of cancellation in the Stripe customer portal, which you reach through "Manage billing" in your Portal, or by email to hello@rep4.eu from the contact address on file. We confirm every cancellation by email.

7.3 Termination for cause. Either party may terminate the contract for cause with immediate effect if the other party materially breaches these Terms and does not remedy the breach within 14 days of a written notice describing it, or if the other party becomes insolvent. We may also terminate for cause if verification fails or cannot be repeated (Section 4.5), if a renewal payment remains unpaid (Section 6.5), if your processing appears to be unlawful or exposes us to liability we cannot reasonably accept, if you use the Service to mislead authorities or data subjects, if sanctions or embargoes prohibit us from continuing, or if a change in law or professional rules prevents us from acting as your representative.

7.4 Refund on termination for our breach. If you terminate for cause because of a material breach by us, we refund the part of the fee that relates to the remainder of the current Term on a pro-rata basis.

7.5 Effects of termination. When the contract ends:

• our designation as your representative ends on the same date, and you remove our details from your privacy notice and other documents within 14 days;
• if you still need a representative, appointing a new one is your responsibility, and we recommend doing so before the designation ends;
• we may inform supervisory authorities and anyone who contacts us about you that the designation has ended;
• for 30 days after the end date we continue to forward communications received at your Forwarding Address, after which the address is deactivated;
• your Portal access ends, so download the documents you need beforehand; and
• we retain your Designation Letters, verification documents and communications log for the retention period in Section 9.4.

8. Service levels and availability

8.1 Targets. The forwarding and support times in Sections 2.4 and 2.7 are service targets that we pursue with reasonable care. They are not guarantees, and missing a target on its own does not entitle you to a reduction of the fee.

8.2 Delays outside our control. We are not responsible for delays or failures caused by email providers, spam filters, postal services, incorrect or unreachable contact details you gave us, or events of force majeure (Section 14.3).

8.3 Filtering. We may filter or block spam, malware and abusive content, and we may decline to forward material whose forwarding would be unlawful. We will tell you when we withhold a communication addressed to you.

8.4 Portal availability. We operate the Portal with reasonable availability and may take it offline for maintenance, updates and security reasons, if possible outside German business hours. We may change or improve Portal features over time as long as the core Service in Sections 2.1 to 2.4 is not materially reduced.

8.5 Business days. Business days are Monday to Friday, excluding public holidays in North Rhine-Westphalia, Germany.

9. Confidentiality and data protection

9.1 Confidentiality. Each party keeps confidential all non-public information it receives from the other in connection with the contract, uses it only to perform the contract, and discloses it only to employees, advisors and subcontractors who need to know it and are bound by equivalent obligations. This does not apply to information that is public, that the receiving party already lawfully held, or that must be disclosed by law. The obligation continues for three years after the end of the contract.

9.2 Disclosure to authorities. As your representative we are required to cooperate with supervisory authorities. We may disclose your identity and contact details, the Designation Letter, the record of processing activities you gave us and the communications log in response to a lawful request from a supervisory authority or court. We will inform you promptly of any such request unless we are prohibited from doing so.

9.3 Personal data. For the account, contact and billing data of your staff, we are the controller, and our Privacy Policy applies. Personal data contained in communications that we receive and forward as your representative is processed only to perform the mandate, on infrastructure located in the European Union, and is retained as set out in Section 9.4. Where the law requires a data processing agreement between us, we will sign our standard data processing agreement on request.

9.4 Retention. Designation Letters, verification documents and the communications log are evidence of the designation and of what we received and forwarded. We store them immutably and retain them for seven years after the end of the Term in which they were created, to meet our statutory retention obligations and to be able to evidence the designation towards authorities. Export and deletion requests that you submit through the Portal are honoured subject to this retention.

9.5 Security. We protect the Portal and your documents with appropriate technical and organisational measures, including encryption in transit and at rest, access controls and audit logging. Our customer data is hosted in data centres in Germany.

10. Intellectual property and use of the designation letter

10.1 Ownership. The website, the Portal, our document templates, the format of the Designation Letter and the privacy-notice wording remain our property or that of our licensors.

10.2 Licence. During the Term you may use the Designation Letter and the privacy-notice wording to evidence the designation and to comply with the GDPR: you may show the letter to supervisory authorities, customers, partners and auditors, and you may publish the wording in your privacy notice and on your website.

10.3 No alteration. You will not alter the Designation Letter. Only the most recent version issued to you evidences a current designation; earlier versions are historical records.

10.4 After the Term. After the contract ends you may keep copies of your Designation Letters as evidence of the past designation, but you will not present them as evidence of a current designation.

10.5 Feedback. We may use suggestions and feedback you give us to improve the Service without any obligation to you.

11. Warranties, liability and indemnity

11.1 Our commitment. We provide the Service with reasonable care and skill and in accordance with Article 27 GDPR. We do not warrant that appointing us makes you compliant with the GDPR, that supervisory authorities will not investigate, fine or take action against you, or that any particular outcome will be achieved.

11.2 Unlimited liability. We are liable without limitation for damage caused intentionally or by gross negligence, for injury to life, body or health, under the German Product Liability Act, for fraudulent concealment of a defect, and to the extent we have given a guarantee.

11.3 Limited liability for slight negligence. In all other cases we are liable for slight negligence only if we breach a material contractual obligation, that is, an obligation whose fulfilment is essential to the proper performance of the contract and on whose fulfilment you regularly rely. In that case our liability is limited to the damage that is foreseeable and typical for this type of contract, and our total liability for all claims arising in a contract year is limited to the fees you paid or owe us for the twelve months preceding the event giving rise to the claim.

11.4 Excluded damage. Subject to Section 11.2, we are not liable for indirect or consequential loss, loss of profit, loss of business, fines or penalties imposed on you by a supervisory authority or court, damage to reputation, or claims brought against you by third parties.

11.5 Staff and agents. Sections 11.2 to 11.4 also apply to the personal liability of our managing directors, employees, representatives and vicarious agents.

11.6 Limitation period. Claims against us under Sections 11.3 and 11.4 become time-barred one year after the statutory limitation period begins to run. This does not apply to claims under Section 11.2.

11.7 Your indemnity. Under Article 27(5) and Recital 80 GDPR, a representative can be the addressee of enforcement measures for the controller's or processor's non-compliance. You will therefore indemnify us and hold us harmless against all claims, fines, penalties, enforcement measures, damages, costs and expenses, including reasonable legal fees, that are raised against or incurred by us in our capacity as your representative or that arise out of your processing of personal data, your breach of the GDPR or of these Terms, inaccurate or incomplete information you provided, or your failure to respond to a communication we forwarded, except to the extent they are caused by our intentional or grossly negligent breach of these Terms. We will inform you promptly of any such claim, will not settle it without consulting you, and you will support us in defending it.

11.8 Mandatory law. Nothing in this Section limits liability that cannot be limited under mandatory law.

12. Changes to the Service and to these Terms

12.1 Changes to the Service. We may improve and change the Service, the Portal and our templates, provided that the core Service in Sections 2.1 to 2.4 is not materially reduced. We will inform you of material changes by email.

12.2 Changes to these Terms. We may amend these Terms, for example to reflect changes in law or regulatory guidance, changes to the Service or security requirements. We will notify you by email at least two (2) months before the amended Terms take effect and will publish the new version at rep4.eu/terms/. Amended Terms apply from your next renewal. If you do not agree to them, you may cancel under Section 7.1. If a change is required by law and must apply sooner, it takes effect on the date stated in the notice, and you may terminate the contract with effect from that date and receive a pro-rata refund for the remainder of the Term.

12.3 Current version. The version published at rep4.eu/terms/ at the time you order or renew applies to that Term. The "Last updated" date at the top of this page identifies the version.

13. Use of the website and free resources

13.1 Information only. The articles, guides, glossary, comparison pages, checklists and the free risk assessment on rep4.eu are general information about GDPR Article 27 and related topics. They are not legal advice, do not take your specific circumstances into account and do not create an attorney-client or other advisory relationship. The result of the free assessment is an indication, not a legal determination.

13.2 No warranty. We keep the website content up to date with reasonable care but do not warrant that it is complete, accurate or current at all times. Information about third-party providers on our comparison pages reflects their published offerings at the date stated on the page.

13.3 Acceptable use. You will not interfere with the operation or security of the website or the Portal, scrape or systematically extract content, or use automated tools to place orders or submit forms.

13.4 Third-party links. Links to other websites are provided for convenience. We are not responsible for their content.

14. General provisions

14.1 Notices. We send notices to the contact email address on file in your Portal, and you are responsible for keeping it current. You send notices to us by email to hello@rep4.eu or by post to the address in Section 1.1. Notices of termination and other legally relevant declarations must be made in text form; email is sufficient.

14.2 Assignment and subcontractors. You may transfer the contract or individual rights under it only with our written consent. We may transfer the contract to an affiliated company or to a successor of our business, and will notify you if we do. We may use subcontractors and service providers to perform the Service, including payment, email and hosting providers established in the EU or subject to appropriate transfer safeguards, and remain responsible for their performance.

14.3 Force majeure. Neither party is liable for a failure to perform caused by events beyond its reasonable control, such as natural disasters, war, terrorism, epidemics, strikes, governmental action, or failures of public networks or of third-party infrastructure that could not reasonably have been prevented. Obligations are suspended for the duration of the event. If it lasts longer than 60 days, either party may terminate the contract with effect from the end of that period, and we refund the fee for the remainder of the Term pro rata.

14.4 Governing law. The contract and these Terms are governed by the laws of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods and the conflict-of-law rules.

14.5 Jurisdiction. If you are a merchant, a legal entity under public law or a special fund under public law, or if you have no general place of jurisdiction in Germany, the exclusive place of jurisdiction for all disputes arising from or in connection with the contract is Cologne, Germany. We may also bring claims against you at your registered seat.

14.6 Language. These Terms are concluded in English. Where we provide a translation, the English version prevails.

14.7 Entire agreement and amendments. These Terms, the order confirmed at checkout and, where applicable, an individually signed agreement contain the entire agreement between us regarding the Service. There are no oral side agreements. Amendments and additions must be made in text form, as must any waiver of this requirement.

14.8 Severability. If a provision of these Terms is or becomes invalid or unenforceable, the remaining provisions remain in force. The invalid provision is replaced by the valid provision that comes closest to its economic purpose. The same applies to any gap.

14.9 No waiver. A failure or delay in exercising a right under these Terms is not a waiver of it.

14.10 Consumer dispute resolution. Because we contract with businesses only, consumer dispute resolution procedures do not apply, and we do not participate in dispute resolution proceedings before a consumer arbitration board.