Terms & Conditions

(1) These Terms apply to all offers, contracts, deliveries and services of the Agency, in particular to the conception, design and technical implementation of websites (hereinafter "Project Services") and to the ongoing service and maintenance package (domain and hosting management, basic technical operation and technical maintenance; hereinafter "Service Offerings", § 9).

(2) Customers of the Agency may be businesses or consumers. A business is anyone who, when concluding the contract, acts in the exercise of their commercial, business or independent professional activity; a consumer is any natural person acting for purposes which are predominantly outside their trade, business or profession. For consumers, these Terms apply subject to the provisions of § 19; clauses that do not apply to consumers under § 19 otherwise remain unaffected. When placing an order, the customer states whether they are ordering as a business or as a consumer.

(3) Conflicting or deviating terms of the customer do not become part of the contract unless the Agency expressly agrees to their validity in writing.

(4) These Terms, in the version valid at the time of conclusion of the contract, also apply to all future business with the customer without the need for renewed inclusion.

(1) Offers of the Agency are generally made in text form (e-mail) and refer to these Terms, which are available at any time at alpworks.at/agb. Prices stated on the website are subject to change and non-binding.

(2) The contract is concluded upon acceptance of the offer by the customer in text form (e-mail is sufficient) or by implied conduct (in particular the provision of content and access for project implementation). If the customer has already confirmed these Terms as part of the onboarding process (e.g. by ticking a checkbox), the contract is also concluded by the implied conduct of both parties, in particular by commencing the collaboration on the basis of the offer. At the latest upon confirmation of the Terms in the payment process (checkbox at the payment link), these Terms including the Data Processing Agreement (annex) are deemed accepted.

(3) The specific scope of services, the project price, the amount of the monthly service fee, the hourly rate for additional services and any minimum term result from the respective offer or order confirmation (hereinafter the "Offer"). In case of conflict, the Offer prevails over these Terms.

(4) The Agency is free to reject enquiries and orders without giving reasons. There is no entitlement to the conclusion of a contract or to the acceptance of follow-up orders.

(5) Declarations in the course of contract performance may be made by both parties in text form (e-mail). The Agency may also use project- or brand-related e-mail addresses for this purpose (e.g. under the domain alpworks.at).

(1) The Agency performs its services in accordance with the state of the art at the time of conclusion of the contract and with the diligence of a proper professional business. It is free in its design decisions insofar as the Offer contains no specific requirements.

(2) The service owed is the service described in the Offer. Unless expressly agreed, the following in particular are not owed: the creation of texts and images, translations, legal reviews, SEO results, a specific search engine ranking, advertising success or specific revenue or visitor figures. Accessibility (e.g. under the German Accessibility Strengthening Act, the European Accessibility Act or comparable regulations) is owed only insofar as expressly agreed; the customer must check for themselves whether their website is subject to such obligations.

(3) The Agency is entitled to engage suitable subcontractors and vicarious agents. It remains responsible for performance in accordance with the contract.

(4) The Agency may use standard third-party components (e.g. content management systems, themes, plugins, website builders, fonts, stock media) as well as AI-assisted tools to create the services. For third-party components, the licence and usage terms of the respective providers additionally apply.

(5) Third-party software and external services: If the Agency, at the customer's request or in the customer's interest, uses paid software, licences or services of third parties (e.g. premium themes and plugins, stock media, booking, administration and reservation tools, newsletter and analytics services, interfaces), the following applies to all services of the Agency: (a) The one-off and ongoing licence, usage and transaction costs of such third-party services are not part of the remuneration under § 5 and are borne by the customer; costs advanced by the Agency are passed on to the customer. (b) Contracts for third-party services are, where possible, concluded directly between the customer and the respective provider; the Agency sets up such services in the name and for the account of the customer. (c) Third-party services are governed exclusively by the contractual, licence and data protection terms of the respective provider; the customer must comply with these and conclude any necessary data protection agreements (in particular data processing agreements regarding the processing of data of their end customers, e.g. guest data in booking tools) directly with the provider. (d) Price changes by third-party providers are passed on to the customer; § 5(6) applies accordingly. Changes, restrictions or discontinuation of services, interfaces or terms by third-party providers do not constitute a defect in the Agency's service; any adjustments required as a result are additional services under § 8(2). (e) If the Agency provides its own (agency) licences, these apply only for the duration of the collaboration; after its end, the customer must acquire the necessary licences themselves, and the deactivation of agency licences does not constitute a defect.

(6) Agreed dates and deadlines are non-binding planning figures unless expressly agreed as binding. Deadlines are extended appropriately if and for as long as the customer fails to meet their cooperation obligations (§ 4).

(1) The customer provides the Agency with all content, information, materials and access required for the performance of the services (e.g. texts, logos, images, access credentials for domain, hosting, existing systems) in good time, completely, in a common format and free of charge.

(2) The customer designates a contact person with decision-making authority and provides feedback on drafts and interim results within a reasonable period, generally within 7 calendar days of being requested to do so.

(3) The customer warrants that they hold the necessary rights to all content they provide and that such content does not infringe the rights of third parties (in particular copyright, trademark, personality or data protection rights). The customer indemnifies the Agency against all third-party claims based on content or specifications provided by the customer, including reasonable costs of legal defence.

(4) The customer is solely responsible for the legal admissibility of their website, in particular for the legal notice, privacy policy, cookie notices and competition and industry-specific regulations. The Agency has no obligation to review content provided, approved or specified by the customer for legal admissibility or conflicting third-party rights. Templates or placeholders provided by the Agency do not constitute legal advice; the Agency recommends a review by a lawyer.

(5) The customer is responsible for backing up their own data and content unless the Agency has expressly undertaken backup services.

(6) If the customer fails to meet their cooperation obligations despite a request and a reasonable grace period, the Agency may charge the resulting additional effort at the hourly rate under § 8 and/or suspend the project. After 60 days of standstill for reasons attributable to the customer, the Agency may invoice the services rendered up to that point on a pro rata basis.

(1) Unless otherwise specified in the Offer, the remuneration consists of a one-off project price (fixed amount) for the Project Services and an ongoing monthly service fee for the service and maintenance package (Service Offerings) under § 9. For businesses, all prices are net, i.e. exclusive of VAT (see § 6); for consumers, final prices apply in accordance with § 19(3).

(2) The project price is due upon completion and provision of the website for acceptance. Payment is made via a payment link transmitted by the Agency from a payment service provider it uses (currently Stripe) or by bank transfer and, unless otherwise stated in the payment link or invoice, is to be made within 14 days. The Agency is entitled, but not obliged, to agree on advance or partial payments in individual cases.

(3) The Agency is entitled to withhold the go-live of the website, the release of access credentials and work results, and the transfer of usage rights and the domain until the project price and any due service fees have been received in full.

(4) The monthly service fee is owed from the go-live of the website, at the latest from the provision of the Service Offerings, and is due monthly in advance. Billing is carried out via a recurring payment profile of the payment service provider used or by invoice.

(5) In the event of late payment, the Agency is entitled to charge default interest of 9 % p.a., a flat-rate default compensation of EUR 15 per reminder and reimbursement of further necessary reminder and collection costs. For failed payments and chargebacks attributable to the customer, the Agency may charge the third-party fees incurred plus a handling fee of EUR 15; the customer retains the right to prove lower costs. § 9(7) (suspension) remains unaffected.

(6) The Agency may adjust the monthly service fee with effect for the future, in particular in the event of cost changes by third-party providers (hosting, domain, licences). Increases are announced to the customer in text form at least one month before they take effect; in this case, the customer may terminate the Service Offerings, in deviation from § 14, as of the date the increase takes effect (special right of termination), including during a minimum term.

(7) Set-off is permitted only with undisputed or legally established counterclaims. The customer has a right of retention only for claims arising from the same contractual relationship.

(8) If the customer cancels or terminates a project order before completion for reasons for which the Agency is not responsible, the Agency retains the right to the agreed project price less what it saves as a result of the work not being carried out or what it earns, or deliberately fails to earn, through other use of its labour (cf. § 1168(1) of the Austrian Civil Code, ABGB).

(1) The Agency has its registered office in the Principality of Liechtenstein and has no permanent establishment in a member state of the European Union.

(2) For services to businesses domiciled in an EU member state (in particular Austria or Germany), the place of supply for VAT purposes is the place of the recipient. The tax liability is transferred to the customer as recipient (reverse charge procedure; in Austria pursuant to § 19(1) in conjunction with § 3a(6) of the Austrian VAT Act, in Germany pursuant to § 13b(1) and (5) in conjunction with § 3a(2) of the German VAT Act, in other member states pursuant to the national implementations of Art. 44 and Art. 196 of Directive 2006/112/EC). Invoices and payment requests of the Agency to such customers are issued without VAT and contain a corresponding note.

(3) In these cases, the customer is obliged to declare and pay the VAT attributable to the service in their country of domicile. This also applies to small businesses within the meaning of the respective national law; any lack of input tax deduction falls within the customer's sphere. The customer informs the Agency of their VAT identification number, if available, and on request provides suitable evidence of their business status (e.g. trade licence, commercial register extract, tax number, business confirmation).

(4) For customers domiciled in Switzerland or Liechtenstein, the service is deemed to be provided within the common VAT territory of Switzerland/Liechtenstein. If and insofar as the Agency is subject to VAT, Swiss or Liechtenstein VAT at the applicable rate (currently 8.1 %) is charged in addition to the net price and shown on the invoice.

(5) If the customer provides incorrect information regarding their business status or domicile and the Agency incurs additional tax claims, interest or penalties as a result, the customer shall indemnify and hold the Agency harmless.

(1) The Agency provides the customer with the completed website or work results for review. The customer reviews them without undue delay and declares approval or notifies specific defects in text form within 14 calendar days.

(2) If neither approval nor a substantiated notice of defects is given within this period, or if the customer puts the service into productive use (in particular go-live of the website), the service is deemed accepted.

(3) Insignificant defects do not entitle the customer to refuse acceptance; they are remedied under the warranty.

(1) Unless otherwise specified in the Offer, the project price includes two revision rounds per design phase. A revision round is the collected, consolidated feedback of the customer on a draft.

(2) Change requests beyond this, subsequent concept changes, extensions of the scope of services and other services not included in the Offer are remunerated separately on a time and material basis at the hourly rate agreed in the respective Offer or on the basis of a separate offer. If no hourly rate is agreed in the Offer, an hourly rate of EUR 60 (net) per hour applies; partial hours are billed pro rata per quarter hour. For businesses, no separate notice of the obligation to pay is required in individual cases; it results from these Terms. Consumers are informed of the expected costs before execution.

(1) The ongoing Service Offerings are offered as a "service and maintenance package". Unless otherwise specified in the Offer, it comprises: (a) the registration or management of a domain on behalf of the customer, (b) the provision and management of web hosting via third-party providers selected by the Agency, (c) the basic technical operation of the website, and (d) technical maintenance in accordance with paragraph 3. The defining main component of the package is the personal support and maintenance of the website performed manually by the Agency's staff; the procurement and management of domain and hosting from third-party providers is an ancillary service to this personal support. The setup and management of third-party software is governed by § 3(5).

(2) The availability of hosting, domain and related services depends on the services and terms of the third-party providers used. The Agency makes no availability commitment of its own; short interruptions (e.g. for maintenance work and updates) are permissible. The Agency is entitled to change the third-party providers used and to technically adapt or further develop the Service Offerings insofar as this is reasonable for the customer taking into account the interests of both parties. The Agency does not owe specific response, processing or recovery times unless expressly agreed.

(3) Technical maintenance is performed personally and manually by the Agency's staff. It comprises the ongoing manual check of the basic reachability of the website and the manual installation of the security and system updates provided by the respective manufacturer for the standard components used, in each case within the bounds of what is technically and economically reasonable and without specific intervals, response or implementation times being owed. The Agency's own automated services performed without substantial human involvement are not part of the package. Also not included are updates and migrations that require adjustments beyond mere installation (in particular major upgrades, the resolution of incompatibilities between third-party components and adjustments to changed interfaces or provider terms); such work constitutes additional services under § 8(2).

(4) Content changes, extensions and support are not part of the service and maintenance package or the monthly service fee. The Agency may carry out minor adjustments (e.g. text corrections, image replacements) at its own discretion and subject to available capacity as a gesture of goodwill; the customer has no legal entitlement to this, nor does one arise from repeated goodwill performance. More extensive work is offered and remunerated separately in accordance with § 8(2).

(5) The rights to the domain belong to the customer; the Agency manages the domain in trust for the duration of the contract. Upon termination of the Service Offerings, the Agency cooperates in the transfer of the domain to the customer or a provider designated by the customer (in particular by releasing the auth code) as soon as all due claims of the Agency have been settled; until then, the Agency has a right of retention. The administrative effort associated with the transfer may be charged in accordance with § 8(2).

(6) The customer may not use the managed systems for unlawful content or activities and may not post (or have posted) content that infringes the rights of third parties. § 4(3) and (4) apply accordingly.

(7) If the customer is in default with the service fee despite a reminder and a reasonable grace period, or violates paragraph 5, the Agency is entitled to temporarily suspend the website and the associated services. The obligation to pay the service fee continues during the suspension.

(1) All work results of the Agency (designs, layouts, graphics, source code, concepts) are protected by copyright or related rights.

(2) Upon full payment of the project price, the Agency grants the customer the non-exclusive right, unlimited in time and territory, to use the contractual work results for the agreed purposes (in particular the operation of their own website). Any further grant of rights (e.g. exclusive rights, resale, transfer to third parties outside the customer's business) requires a separate agreement.

(3) Third-party components (open-source software, CMS, themes, plugins, fonts, stock media) are excluded from the grant of rights; these are governed exclusively by the licence terms of the respective rights holders. Where possible, the Agency selects licences that cover the agreed use.

(4) Drafts and concepts not commissioned remain the property of the Agency and may not be used by the customer without separate remuneration.

(5) The Agency remains entitled to use the generic techniques, know-how, libraries and code modules developed for other projects as well.

(1) The Agency is entitled to name the customer as a reference, stating the company name, logo and a short description of the project, and to use images of the work created for presentation and advertising purposes (website, portfolio, social media, pitch documents).

(2) The Agency is further entitled to place a discreet credit with a link on the website created (e.g. "Design & Development: AlpWorks").

(1) The Agency warrants that the work results substantially correspond to the Offer at the time of acceptance and function properly in the versions of common browsers current at the time of acceptance.

(2) The following in particular do not constitute defects: differences in display on different devices and in outdated browser versions, impairments caused by subsequent updates of third-party software (CMS, plugins, browsers, operating systems), by interventions of the customer or third parties in the system, and disruptions at hosting or other third-party providers.

(3) Defects must be notified without undue delay, at the latest within 14 days of discovery, in text form and in a comprehensible manner; otherwise the service is deemed approved with regard to recognisable defects. The warranty period is six months from acceptance. The customer must prove that a defect already existed at the time of acceptance; statutory presumptions of defectiveness (e.g. § 924 ABGB, § 477 of the German Civil Code, BGB) are waived insofar as permissible. The warranty is fulfilled, at the Agency's option, by rectification or replacement; if this fails twice, the customer may demand a price reduction or, in the case of significant defects, withdraw from the affected individual order.

(4) The assertion of defects does not entitle the customer to withhold due payments. Ongoing maintenance, updates and further development after acceptance are not subject to the warranty.

(1) The Agency is liable without limitation for intent and gross negligence, for culpably caused personal injury and in cases of mandatory statutory liability (e.g. under product liability law).

(2) Liability for slight negligence is excluded, except for personal injury.

(3) Compensation for indirect damage, consequential damage, lost profit, loss of interest, futile expenses, damage from business interruption, data loss (insofar as this could have been avoided by proper data backup by the customer) and damage resulting from outages and actions of third-party providers (in particular hosting, domain registrars, payment services, external APIs) is excluded, except in the cases of paragraph 1.

(4) Insofar as the Agency is liable on the merits, liability per claim and in total per order is limited to the project price agreed for the affected order, and for Service Offerings to the service fees of the last twelve months. This limitation does not apply in the cases of paragraph 1.

(5) Insofar as legally permissible, the injured party must prove the existence of intent or gross negligence; the reversal of the burden of proof under § 1298 ABGB (or comparable provisions) is waived.

(6) Insofar as legally permissible, claims for damages by the customer must be asserted in court within six months of becoming aware of the damage and the party liable, failing which they lapse.

(7) The above limitations also apply in favour of the Agency's corporate bodies, employees, subcontractors and vicarious agents.

(1) The Service Offerings run for an indefinite period. If a minimum term is agreed in the Offer, it begins with the go-live or the provision of the Service Offerings; after its expiry, the contract continues for an indefinite period.

(2) The customer may terminate the Service Offerings in text form with one month's notice to the end of the respective billing period, but at the earliest upon expiry of an agreed minimum term. The special right of termination under § 5(6) remains unaffected.

(3) The Agency may terminate the Service Offerings at any time in text form with one month's notice to the end of the month, including during an agreed minimum term and without giving reasons. Service fees already paid in advance for periods after the termination takes effect are refunded to the customer pro rata; the customer has no further claims arising from such termination.

(4) The right of both parties to extraordinary termination for good cause remains unaffected. Good cause for the Agency exists in particular if the customer is more than 30 days in arrears with payments despite a reminder or violates § 9(6).

(5) Upon termination, the Agency provides the customer, at their request, with the content and data to which they are entitled once within 30 days in a common format chosen by the Agency and cooperates in the domain transfer in accordance with § 9(5). Further migration and relocation services are remunerated on a time and material basis in accordance with § 8(2). Upon termination, the provision of hosting and related services ends; the customer is responsible for backing up and relocating their website in good time.

Both parties treat all confidential information of the other party obtained in the course of the collaboration (in particular business and trade secrets, access credentials, calculations) as confidential and use it exclusively for the performance of the contract. This obligation continues for a period of three years after the end of the contract. Statutory disclosure obligations remain unaffected.

(1) The parties comply with the applicable data protection regulations, in particular Regulation (EU) 2016/679 (GDPR), which is directly applicable in the Principality of Liechtenstein as an EEA member state, and the Liechtenstein Data Protection Act; for customers domiciled in Switzerland, additionally the Swiss Federal Act on Data Protection (FADP).

(2) Insofar as the Agency processes personal data on behalf of the customer (in particular within the service and maintenance package under § 9), the Data Processing Agreement pursuant to Art. 28 GDPR (annex to these Terms) applies, which forms part of the contract and is accepted together with these Terms.

(3) Information on the processing of personal data of the customer and their contact persons by the Agency as controller can be found in the privacy policy, available at alpworks.at/datenschutz.

Events of force majeure (including natural disasters, war, pandemics, official measures, large-scale failures of power, network or cloud infrastructure, unavoidable absences of key staff, in particular due to illness) which substantially impede or prevent the Agency's performance entitle the Agency to postpone performance for the duration of the impediment plus a reasonable start-up period. If the impediment lasts longer than 60 days, both parties may withdraw from the affected order; services already rendered are to be remunerated.

(1) The law of the Principality of Liechtenstein applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG) and the conflict-of-law rules of private international law.

(2) The exclusive place of jurisdiction for all disputes arising from or in connection with this contract is Vaduz, Principality of Liechtenstein. The Agency is also entitled to sue the customer at the customer's general place of jurisdiction.

(3) Amendments and supplements to the contract must be made in text form (e-mail is sufficient); this also applies to the waiver of this text form requirement.

(4) Should individual provisions of these Terms be or become wholly or partially invalid or unenforceable, the validity of the remaining provisions remains unaffected. In place of the invalid provision, the valid provision that comes closest to the economic purpose of the invalid provision is deemed agreed.

(5) The Agency is entitled to amend these Terms with effect for the future. For ongoing Service Offerings, amendments are communicated to the customer in text form at least one month before they take effect; if the customer does not object within one month, the amended Terms are deemed accepted. The customer is informed of this legal consequence in the notification.

(6) Rescission of the contract on the grounds of laesio enormis (in particular § 934 ABGB) is mutually excluded insofar as legally permissible (cf. § 351 of the Austrian Commercial Code, UGB). The contract language is German.

(7) The customer may transfer rights and obligations under the contract to third parties only with the prior consent of the Agency in text form; the Agency is entitled to transfer the contract with all rights and obligations to a company affiliated with it.

(8) Claims of the customer arising from or in connection with the contract, with the exception of claims under § 13(1), become time-barred one year after the statutory commencement of the limitation period, insofar as legally permissible.

(1) If the customer is a consumer (§ 1(2)), these Terms apply subject to the following provisions. The remaining provisions remain unaffected insofar as they do not conflict with mandatory consumer protection regulations.

(2) Right of cancellation: For contracts concluded exclusively at a distance (e.g. by e-mail and online payment), consumers have the statutory right of cancellation of 14 days from conclusion of the contract. Details, the effects of cancellation and the model cancellation form are set out in the cancellation policy (annex), which is sent to the consumer with the Offer. If the consumer expressly requests that the Agency begin performance before the end of the cancellation period, they owe, in the event of cancellation, a proportionate amount for the services rendered up to the cancellation; the right of cancellation expires upon full performance of the contract if the consumer has expressly consented to early performance and confirmed their knowledge of the loss of the right of cancellation. The Agency contractually grants the same right of cancellation to consumers habitually resident in Switzerland.

(3) Prices and taxes: For consumers, all stated prices are final prices including any applicable VAT. § 6(2) and (3) (reverse charge) do not apply to consumers; any statutory VAT attributable to services to consumers is paid by the Agency.

(4) Warranty: Consumers are entitled to the statutory warranty rights without restriction, including the statutory periods and any obligation to provide updates for digital services. § 12(3) and § 12(4) sentence 1 do not apply to consumers.

(5) Liability: For consumers, § 13 applies subject to the following: The exclusion under § 13(2) does not apply to the breach of essential contractual obligations (obligations whose fulfilment is essential for the proper performance of the contract and on whose compliance the customer may regularly rely); in this respect, liability is limited to the foreseeable damage typical for the contract. The limitation under § 13(4) does not apply in the case of gross negligence. § 13(5) and (6) as well as shortened limitation and exclusion periods of these Terms (in particular § 18(8)) do not apply to consumers.

(6) Default: Consumers owe default interest at the statutory rate; § 5(5) does not apply in this respect. Only the reminder and collection costs necessary for appropriate enforcement, in a reasonable amount, are recoverable.

(7) Set-off and retention: In deviation from § 5(7), the consumer may also set off counterclaims that are legally connected with their obligation, have been established by a court or acknowledged by the Agency, and in the event of the Agency's insolvency. The consumer's statutory rights of retention and refusal of performance remain unaffected; § 12(4) sentence 1 does not apply.

(8) Price changes under § 5(6) take effect for consumers at the earliest two months after conclusion of the contract; cost reductions are passed on according to the same standards.

(9) Minimum term: A minimum term of the Service Offerings agreed with consumers is at most twelve months.

(10) Choice of law and jurisdiction: The choice of law under § 18(1) does not affect mandatory consumer protection provisions of the state in which the consumer has their habitual residence. § 18(2) (place of jurisdiction) and § 18(6) sentence 1 (laesio enormis) do not apply to consumers; the statutory places of jurisdiction apply.

(11) Dispute resolution: The Agency is neither obliged nor willing to participate in dispute resolution proceedings before a consumer arbitration board.

Last updated: 30 July 2026. Three Purple Blocks AG, Schaanerstrasse 99, 9490 Vaduz, Liechtenstein — trading under the brand AlpWorks (alpworks.at).

(1) The Processor processes personal data on behalf of the Controller insofar as this is necessary for the provision of the services under the Main Contract, in particular in the course of: creating, setting up, maintaining and servicing websites and web applications; managing hosting, domain and e-mail services; setting up and managing forms, newsletter, analytics, booking and administration tools; support and troubleshooting work with access to the Controller's systems.

(2) The duration of the processing corresponds to the term of the Main Contract, unless obligations extending beyond it arise from this agreement.

(1) Nature and purpose: collection, storage, adaptation, retrieval, transmission and erasure of personal data for the purpose of creating and technically operating or maintaining the Controller's web presence.

(2) Categories of data subjects: visitors and users of the Controller's website; customers, prospects, guests and suppliers of the Controller; employees and contact persons of the Controller; newsletter subscribers.

(3) Types of personal data: contact and master data (name, address, e-mail, telephone); content data (e.g. form entries, comments, booking data); usage data and metadata (IP addresses, log files, cookie and analytics data); contract data and, where applicable, payment data, insofar as processed via the managed systems. Special categories of personal data (Art. 9 GDPR) are not subject to the engagement unless expressly agreed separately.

(1) The Processor processes personal data only on documented instructions from the Controller, unless required to do so by EU, EEA or Member State law; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information.

(2) The Main Contract, the service description and this agreement constitute the general instructions. Individual instructions must be given in text form. If the Processor considers an instruction to be unlawful, it shall inform the Controller without undue delay and may suspend implementation until the instruction is confirmed or amended.

(3) As between the parties, the Controller alone is responsible for the lawfulness of the processing (Art. 24 GDPR), in particular for the existence of legal bases, the fulfilment of information obligations and the safeguarding of data subjects' rights vis-à-vis the data subjects. If a third-party claim or an official measure is based on an instruction of the Controller or on the unlawfulness of processing for which the Controller is responsible, the Controller shall indemnify and hold the Processor harmless.

• It ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).
• It takes all technical and organisational measures (TOMs) required pursuant to Art. 32 GDPR; the measures implemented at the time of conclusion of the contract are described in Annex 1 and may be adapted to the state of the art, provided that the level of protection is not reduced.
• Taking into account the nature of the processing, it assists the Controller by appropriate measures in responding to requests from data subjects (Art. 12–23 GDPR) and in complying with the obligations under Art. 32–36 GDPR (security, notification of breaches, data protection impact assessment). For assistance services that are not based on a breach of obligations by the Processor, the Processor may charge reasonable remuneration on a time and material basis.
• It notifies the Controller of personal data breaches without undue delay after becoming aware of them, including the information required under Art. 33(3) GDPR, insofar as available.
• It notifies the Controller without undue delay of inspections and enquiries by supervisory authorities insofar as they relate to the processing on behalf of the Controller, as well as of requests for access from data subjects received directly by the Processor; a response is given only on the instructions of the Controller.
• It makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allows for and contributes to audits – including inspections – conducted by the Controller or an auditor mandated by the Controller; the time and scope shall be agreed in good time, and for audits without a specific reason the Processor may charge reasonable remuneration for the effort involved.
• Where legally required, it maintains a record of processing activities pursuant to Art. 30(2) GDPR and, where legally required, designates a data protection officer.

(1) The Controller hereby grants general authorisation for the engagement of sub-processors. The sub-processors engaged at the time of conclusion of the contract are listed in Annex 2.

(2) The Processor informs the Controller in text form of any intended changes (addition or replacement). The Controller may object within 14 days on important data protection grounds. If no reasonable solution can be found in such a case, both parties are entitled to terminate the affected service.

(3) The Processor contractually imposes on each sub-processor essentially the same data protection obligations as set out in this agreement. In the case of processing in third countries outside the EEA, it ensures an adequate level of data protection (adequacy decision, EU Standard Contractual Clauses or other appropriate safeguards pursuant to Art. 44 et seq. GDPR).

(4) Third-party providers whose services the Controller obtains directly pursuant to § 3(5) of the Terms and Conditions (e.g. booking and administration tools, newsletter or analytics services with their own contractual relationship with the Controller) are not sub-processors of the Processor. In this respect, it is the Controller's responsibility to conclude the necessary data processing agreements directly with the respective provider; the Processor accesses such systems only as a person authorised by the Controller.

(1) The Processor rectifies, erases or restricts the processing of the data subject to the engagement when instructed to do so by the Controller.

(2) After completion of the provision of services, the Processor, at the choice of the Controller, deletes all personal data or returns it and deletes existing copies, unless a statutory retention obligation applies. Deletion shall be confirmed on request.

(1) Liability is governed by Art. 82 GDPR. As between the parties, the limitations of liability of the Main Contract additionally apply to claims in connection with this agreement, insofar as mandatory law does not provide otherwise.

(2) In the event of conflicts between this agreement and the Main Contract, the provisions of this agreement prevail with regard to data protection.

(3) The law of the Principality of Liechtenstein applies; mandatory provisions of the GDPR and of the data protection law applicable at the Controller's registered office remain unaffected. The place of jurisdiction is Vaduz.

(4) Amendments and supplements must be made in text form. Should any provision be invalid, the validity of the remaining provisions shall remain unaffected.

• Physical and system access control: encrypted devices, password manager, two-factor authentication for all systems containing customer data, individual user accounts, lock screens.
• Data access control: permissions on a need-to-know basis, immediate revocation of permissions upon departure, logging of administrative access where technically possible.
• Transfer control: encrypted transmission (TLS/SSH/SFTP/VPN), no transmission of access credentials in plain text by e-mail.
• Input control: traceability of changes through version control (e.g. Git) and system logs.
• Availability control: regular backups of the managed systems (where commissioned), selection of hosting providers with appropriate availability and security standards.
• Separation control: separate processing of the data of different customers (separate projects, instances, repositories).
• Organisation: confidentiality commitment of all staff, regular awareness training, documented process for data protection incidents, review of sub-processors prior to engagement.

• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg – cloud infrastructure and hosting; processing generally in EU/EEA regions, for any access from third countries the EU Standard Contractual Clauses or the EU-US Data Privacy Framework apply (Amazon Web Services, Inc. is certified).
• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA – hosting and deployment platform; transfer to the USA on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
• Regery (domain registrar, domiciled in Ukraine) – domain registration and management (registrant data such as name, address, e-mail); transfer to Ukraine on the basis of the EU Standard Contractual Clauses or the provider's data processing agreement.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – e-mail (Gmail) and collaboration (Google Workspace) for project communication and file exchange; for any transfers to Google LLC, USA, the EU-US Data Privacy Framework and the EU Standard Contractual Clauses apply.
• GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (Microsoft group) – source code management and versioning of the managed projects; transfer to the USA on the basis of the EU-US Data Privacy Framework.
• Zoom Communications, Inc., 55 Almaden Blvd, San Jose, CA 95113, USA – video conferencing and coordination meetings; transfer to the USA on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
• Payment service provider (currently Stripe Payments Europe Ltd., Ireland) – payment processing, insofar as set up on behalf of the Controller; for the agency's own payment processing, the payment service provider is not a sub-processor but an independent controller or service provider of the agency.
• Not covered: third-party software with a direct contractual relationship between the Controller and the provider (e.g. booking and rental tools such as Smoobu, reservation or point-of-sale systems) – see § 5(4); in this respect, the Controller concludes the data processing agreement directly with the provider.

Last updated: 30 July 2026.

You have the right to cancel this contract within fourteen days without giving any reason. The cancellation period is fourteen days from the day of the conclusion of the contract.

To exercise your right of cancellation, you must inform us (Three Purple Blocks AG, Schaanerstrasse 99, 9490 Vaduz, Principality of Liechtenstein, e-mail: hello@threepurpleblocks.li) of your decision to cancel this contract by means of a clear statement (e.g. a letter sent by post or an e-mail). You may use the attached model cancellation form, but this is not mandatory.

To meet the cancellation deadline, it is sufficient for you to send your communication concerning your exercise of the right of cancellation before the cancellation period has expired.

If you cancel this contract, we shall reimburse to you all payments received from you without undue delay and in any event not later than fourteen days from the day on which we are informed about your decision to cancel this contract. We will carry out such reimbursement using the same means of payment as you used for the initial transaction, unless you have expressly agreed otherwise; in any event, you will not incur any fees as a result of such reimbursement.

If you requested that the services begin during the cancellation period, you shall pay us an amount which is in proportion to the services provided up to the time you informed us of your exercise of the right of cancellation with regard to this contract, in comparison with the full scope of the services provided for in the contract.

In the case of a contract for services, the right of cancellation expires if we have fully performed the service and only began performing the service after you gave your express consent and at the same time confirmed your knowledge that you lose your right of cancellation upon full performance of the contract by us.

In the case of digital content not supplied on a tangible medium, the right of cancellation expires if we began performance after you expressly consented to us beginning performance before the end of the cancellation period and you confirmed your knowledge that you thereby lose your right of cancellation.

(If you wish to cancel the contract, please complete and return this form.)

• To: Three Purple Blocks AG ("AlpWorks"), Schaanerstrasse 99, 9490 Vaduz, Principality of Liechtenstein, e-mail: hello@threepurpleblocks.li

• I/We (*) hereby cancel the contract concluded by me/us (*) for the provision of the following service: ______________________________
• Ordered on (*) / received on (*): ______________________________
• Name of consumer(s): ______________________________
• Address of consumer(s): ______________________________
• Signature of consumer(s) (only if this form is notified on paper): ______________________________
• Date: ______________________________

(*) Delete as appropriate.

Last updated: 30 July 2026.