General Terms and Conditions (GTC) of cargo protection gf GmbH As of: September 2026 Important notice: This document is an English translation of the General Terms and Conditions of cargo protection gf GmbH, which were drawn up in German. The German version shall always be deemed the sole valid and legally binding version and shall prevail in the event of any discrepancies or differences in interpretation (see Clause 20(4)). Errors in translation excepted. 1. Scope of Application (1) These General Terms and Conditions (hereinafter “GTC”) apply to all services provided by cargo protection gf GmbH, Mitterstrasse 287a, A- 8073 Seiersberg-Pirka, company register number FN 685320 z, Regional Court for Civil Matters Graz (Landesgericht für Zivilrechtssachen Graz) (hereinafter “cargo protection”), to its customers, in particular to (a) the provision of the software-based platform for the verification and assessment of transport companies (carrier verification, CP-Rating, plausibility check of freight offers, reporting of damage and incidents), (b) transport-related risk management services for transports by road, air and sea, (c) consulting services and (d) seminars, courses and training sessions. (2) cargo protection provides its services exclusively to entrepreneurs (Unternehmer) within the meaning of Section 1 of the Austrian Commercial Code (UGB) or Section 1 of the Austrian Consumer Protection Act (KSchG) (B2B). The conclusion of a contract with consumers is excluded. By concluding the contract, the customer confirms that it is using the services as an entrepreneur for the purposes of its business. (3) These GTC apply exclusively. Conflicting, deviating or supplementary terms and conditions of the customer shall not become part of the contract, even if cargo protection does not expressly object to them or performs services without reservation in the knowledge of such terms, or if such conflicting terms appear on orders, documents or the like of the customer and cargo protection does not once again separately and expressly object to them. Any conditions or restrictions conflicting with or contrary to these GTC are hereby expressly objected to. Deviations/amendments require the express written consent of cargo protection in order to be legally binding. (4) These GTC, as amended from time to time, shall also apply to all future transactions with the customer without the need for any renewed reference to them. Amendments to the GTC shall be notified to the customer in text form at least one month before they take effect; if the customer does not object within one month of receipt, the amended GTC shall be deemed accepted, provided that the notification drew attention to this legal consequence. In the case of amendments which place the customer at a significant disadvantage and are not required by law or case law, the customer shall have a special right of termination with effect as of the date on which the amendment takes effect. 2. Definitions – “Platform”: the application provided by cargo protection as software-as-a-service, including databases, interfaces and evaluations. – “Verification Service”: the collection, consolidation, plausibility checking and assessment of information about transport companies (in particular identity, licences, proof of insurance, documents, operational history), including the issuing of a rating (CP-Rating) or verification report. – “Risk Management Service”: the transport-related risk analysis and risk assessment for road, air and sea transports, including recommendations on prevention and loss avoidance. – “Work Results”: ratings, reports, analyses, recommendations, training materials and other results covered by the engagement. – “Third-Party Sources”: public registers, governmental and private data sources, credit agencies, documents and information provided by the transport company being verified or by the customer, and other external sources of information. – “Interfaces”: technical connections (in particular APIs) to Third-Party Sources and to technical service providers via which data are retrieved, transmitted or processed. 3. Subject Matter of the Services (1) The specific scope of services is set out in the respective offer, the order confirmation or the selected service or package description. Product descriptions, brochures and website content are non-binding and do not constitute any assurance of characteristics or of any (financial) benefit to the customer of whatever nature. (2) Unless expressly agreed otherwise in writing, cargo protection owes diligent performance in accordance with the state of the information and methods available at the time the services are rendered (obligation of means – Bemühensschuld), but not a specific economic result, in particular not the prevention of freight fraud, cargo theft, cargo embezzlement, transport damage or other financial losses of the customer. (3) cargo protection is entitled to engage competent third parties (subcontractors, data suppliers, interface and verification services, OCR and analysis services, hosting and cloud providers) for the performance of its services. (4) An accessible design of the Platform and the Work Results within the meaning of the applicable accessibility regulations (in particular the Federal Disability Equality Act [Bundes-Behindertengleichstellungsgesetz] and the Accessibility Act [Barrierefreiheitsgesetz]) is not owed unless it has been expressly agreed separately; it is incumbent upon the customer to examine whether an accessible design is required for its intended use. The customer shall itself examine content provided by it for its legal admissibility (in particular under competition, trademark, copyright and data protection law); in this respect, cargo protection shall be liable only in accordance with Clause 13. 4. Nature and Limits of the Verification and Information Services (1) The Verification Services and the CP-Rating are information and support services. They are based on Third-Party Sources and on information which is accessible to cargo protection at the time of verification and over whose content cargo protection has no influence whatsoever. cargo protection does not warrant the accuracy, completeness, timeliness or authenticity of the information originating from Third-Party Sources or of the documents submitted. Professionally forged documents, identities or information may remain undetected despite careful verification. (2) Ratings, verification reports and risk analyses are snapshots as of the respective reference date. Subsequent changes (e.g. revocation of a licence, change of insurer, insolvency, takeover of the verified company by third parties) are not covered by the Verification Service unless ongoing monitoring has been expressly agreed. (3) The customer is aware that private providers do not have direct access to certain official registers (in particular the European Register of Road Transport Undertakings, ERRU). The Verification Services therefore cannot replace official checks and do not claim to reflect all information available to the authorities. (4) Work Results are a basis for decision-making and recommendations. The decision on the engagement, selection or continued engagement of a transport company, on the performance of a transport and on the type and scope of security and insurance measures is made exclusively by the customer on its own responsibility. The statutory and contractual duties of care and selection of the customer (in particular as consignor, principal or freight forwarder) remain unaffected and are neither assumed nor restricted by the services of cargo protection. (5) The services of cargo protection do not constitute legal advice, tax advice, insurance brokerage or an expert opinion in the judicial sense, unless the latter is expressly commissioned separately. Accordingly, cargo protection bears no liability whatsoever within the meaning of Section 1299 of the Austrian Civil Code (ABGB). (6) In particular, cargo protection does not guarantee that (a) cases of fraud, deception or embezzlement will be detected, prevented or ruled out, (b) a verified company actually exists, is economically capable or will comply with its contractual obligations, (c) a transport will be performed properly, or (d) damage, financial losses or other risks of the customer – including the rejection, reduction or refusal of insurance benefits – will be avoided. (7) The Platform uses automated analysis procedures, optical character recognition (OCR) and AI-based systems for the structuring, plausibility checking and assessment of information and documents. Despite careful development, quality assurance and continuous further development, misclassifications, incomplete or incorrect results, AI- typical erroneous outputs (so-called hallucinations) and technical malfunctions cannot be ruled out. The Platform does not make any autonomous decisions with legal effect vis-à- vis the customer or third parties. (8) Ratings, risk indicators, warnings and comparable outputs of the Platform are professional assessments based on automated and, where applicable, manual evaluations of the available information. They constitute neither statements of fact about the verified company nor legal assessments or binding statements. (9) A particular rating (e.g. CP-A) does not constitute a guarantee of creditworthiness or reputability and does not give rise to any obligation on the part of cargo protection to answer for the future conduct or the future performance capability of the rated company. 5. Conclusion of Contract (1) Offers made by cargo protection are subject to change and non-binding. The contract is concluded by written order confirmation from cargo protection, by activation of the customer account on the Platform or by commencement of the performance of services. (2) cargo protection is entitled to reject registrations, orders and the activation of customer accounts without stating reasons, and to check registrations for plausibility and suspected misuse prior to activation. (3) cargo protection may grant free or discounted trial access with a scope limited in time, functionality or quantity. Trial access serves exclusively for evaluation purposes, does not give rise to any entitlement to permanent use or to specific functions and may be revoked at any time. Use subject to charges shall only commence after the end of the trial period if this has been agreed. These GTC, in particular Clause 13 (Liability), also apply to trial periods and other services provided free of charge. (4) There are no oral side agreements, and such agreements have no legal effect whatsoever. Amendments and supplements to the contract must be made in writing (including by e- mail); this also applies to any waiver of the written form requirement. 6. Customer’s Obligations to Cooperate (1) The customer shall provide cargo protection with all information, documents and access required for the performance of the services in a timely, complete and correct manner. The customer is solely responsible for the accuracy and lawfulness of the data provided by it (including the admissibility of their transmission under data protection law). (2) The customer shall keep the access credentials for the Platform confidential, protect them against access by unauthorised persons and notify cargo protection without undue delay of any suspected misuse. Actions performed using the customer’s access credentials shall be attributed to the customer. (3) The customer shall check Work Results for plausibility before taking any decisions or measures based on them and shall give notice of obvious inaccuracies without undue delay. If the customer breaches its obligations to cooperate, cargo protection shall not be responsible for any deficiencies in performance, delays and damage caused thereby; additional expenditure may be invoiced separately. 7. Rights of Use (1) For the term of the contract, the customer receives the non-exclusive, non-transferable and non-sublicensable right to use the Platform for its own business purposes. (2) Work Results may be used exclusively for the internal purposes of the customer. Any disclosure to third parties (in particular to verified transport companies or to the customer’s principals), publication or use for advertising purposes is only permitted with the prior written consent of cargo protection. Disclosure to insurers, legal advisers and authorities is permitted without separate consent insofar as this is necessary to safeguard the legitimate interests of the customer (in particular claims handling, legal enforcement) or to fulfil statutory obligations. In the event of disclosure without the required consent, the customer shall fully indemnify and hold cargo protection harmless against claims of third parties. In the case of any permitted disclosure, the customer shall ensure that such disclosure is permissible under data protection law and that Work Results are not misleadingly presented as binding findings, official verifications or guarantees of cargo protection. (3) All copyrights and related rights in the Platform, databases, assessment methods (including the CP-Rating model), training materials and other Work Results remain with cargo protection. Any systematic extraction, reproduction or further exploitation of database contents (screen scraping, data mining) is prohibited. (4) The customer is in particular prohibited from (a) circumventing technical protective measures of the Platform, (b) introducing malware or uploading unlawful content, (c) carrying out automated mass access, (d) reverse engineering, analysing or replicating the Platform, its verification mechanisms, algorithms, assessment and scoring systems, and (e) using the Platform or Work Results for the development, training or improvement of competing products or services. In the event of culpable serious breaches, cargo protection reserves the right to claim damages as well as reimbursement of reasonable costs of legal action. (5) Access credentials and user accounts are personal and may only be used by the natural person to whom they are assigned; the shared use of a user account by several persons (account sharing) is not permitted without the express written consent of cargo protection. The number of user accesses depends on the service package booked. 8. Use of Interfaces, Data Suppliers and Technical Service Providers (1) For the performance of its services, cargo protection uses Interfaces to Third-Party Sources and technical service providers, in particular to or from public and private registers and databases, credit agencies and credit rating services, identity and verification services, document and text recognition services (OCR), analysis and AI-based evaluation services, and hosting and cloud infrastructure providers. The customer acknowledges and agrees that the content, scope, quality, timeliness and availability of the data obtained via Interfaces depend on the respective third-party providers. (2) cargo protection selects third-party providers with the diligence of a prudent entrepreneur, but has no influence on their data holdings, update cycles, technical availability and contractual terms. Clause 4 applies with regard to the accuracy, completeness and timeliness of the data obtained via Interfaces. (3) If third-party providers change, restrict or terminate their interfaces, data sources or terms of service, cargo protection is entitled to adapt the affected services, to switch to equivalent sources or – insofar as a replacement is not possible with reasonable effort – to discontinue the affected part of the services. No claims of the customer shall arise therefrom, provided that the essential character of the services is preserved; if essential parts of the services cease to apply, the customer shall be entitled to an appropriate right of price reduction or termination with regard to the affected service. (4) Insofar as personal data are processed in the course of using Interfaces and technical service providers, this is done in accordance with Clause 17 (Data Protection). cargo protection shall make a current list of the subcontractors and processors used available to the customer on request or at https://cargo-protection.com/subprocessors. (5) cargo protection shall be liable for disruptions, outages, delays or faulty data deliveries of Interfaces, Third-Party Sources and technical service providers exclusively in accordance with Clause 13 (Liability) and only to the extent that it is itself responsible for the disruption; any fault of the third-party provider shall not be attributed to cargo protection as its own fault, unless such provider is a vicarious agent in the narrower sense. 9. Availability and Maintenance of the Platform (1) cargo protection endeavours to ensure a high availability of the Platform, but – subject to an expressly agreed service level agreement – does not owe any specific minimum availability. Maintenance work, updates, disruptions at third-party providers and Interfaces within the meaning of Clause 8 as well as circumstances of force majeure may lead to temporary restrictions and do not give rise to any claims of the customer. (2) cargo protection is entitled to block access temporarily or – after an unsuccessful warning, except in the case of serious breaches – permanently if misuse, security risks, unlawful use, a breach of Clause 7, account sharing or a threat to the Platform, other customers or the technical infrastructure exists or is seriously imminent. The claims of cargo protection to remuneration remain unaffected by a justified block. In the event of a well-founded suspicion of fraud or misuse, cargo protection is furthermore entitled to maintain and apply platform-wide blocking and warning lists insofar as this is necessary for the protection of the Platform and its customers and is legally permissible. (3) cargo protection is entitled to further develop, change or discontinue the range of functions and the data sources of the Platform, provided that the essential character of the services is preserved. (4) If a minimum availability (service level) is separately agreed with the customer, the point of transfer of the Platform to the internet (router exit of the data centre of cargo protection or of its hosting provider) shall be decisive for its calculation. Excluded from the calculation are announced maintenance windows, outages of third-party services, Interfaces and external registers, disruptions within the customer’s sphere (in particular its IT infrastructure and internet connection) and force majeure. 10. Fees and Terms of Payment (1) The fees shown in the offer or in the respective current price list apply, plus value added tax at the statutory rate. Unless stated separately, the amounts are therefore net prices. Unless otherwise agreed, recurring fees are invoiced annually in advance; usage-based fees (query quotas) are invoiced in accordance with the selected tier. Any use exceeding the agreed quota may be invoiced additionally in accordance with the price list applicable at the time. (2) Invoices are due for payment without deduction within 14 days of the invoice date. In the event of default in payment, default interest pursuant to Section 456 UGB shall apply; cargo protection is entitled to charge dunning fees and lawyers’ collection costs and, after prior notice, to block access to the Platform until payment has been made in full. (3) cargo protection is entitled to adjust recurring fees once a year in line with the development of the consumer price index (VPI) published by Statistics Austria (base: VPI [year]). In addition, cargo protection is entitled to adjust fees for future contract periods appropriately insofar as the costs of providing the services demonstrably change, in particular due to increased interface, licence, data, hosting or infrastructure costs, security measures or changed regulatory requirements. Fee adjustments shall be notified to the customer in text form at least two months before they take effect. (4) If a fee increase – with the exception of the adjustment in line with the consumer price index – exceeds 20% of the most recently agreed fee within one contract year, the customer shall have a special right of termination with effect as of the date on which the increase takes effect; if the customer does not give notice of termination within one month of receipt of the notification, the adjustment shall be deemed accepted. 11. Term and Termination (1) Unless otherwise agreed, contracts for the use of the Platform are concluded for a term of twelve months and are each extended by a further twelve months unless terminated in writing no later than three months before expiry. (2) The right to extraordinary termination for good cause remains unaffected. Good cause for cargo protection exists in particular in the event of default in payment despite the setting of a grace period, material breach of the terms of use, disclosure of Work Results to third parties without consent, or the opening of insolvency proceedings over the assets of the customer. (3) Upon termination of the contract, the rights of use of the Platform expire. Fees already paid for unused query quotas shall not be refunded unless cargo protection is responsible for the non-use. Statutory retention obligations and the deletion of personal data after termination of the contract are governed by Clause 17 (Data Protection) and the data processing agreement. 12. Warranty (1) The customer must give notice of defects in writing and in specific terms without undue delay, but no later than within 14 days of receipt of the Work Result or of the defect becoming recognisable (Section 377 UGB); otherwise, claims under warranty, on the grounds of mistake and for damages on account of the defect are excluded. (2) cargo protection shall initially provide warranty by way of improvement or supplementation of what is missing (remedial work within a reasonable period). Price reduction or rescission of the contract shall only be considered after the remedial work has failed twice. The warranty period is six months from performance of the services. Section 924 ABGB (presumption of defectiveness) and Section 933b ABGB shall not apply, to the extent permitted by law. (3) The following in particular do not constitute defects: deviations based on incorrect or incomplete Third-Party Sources or customer information; subsequent changes in the circumstances of the verified company; and assessments, forecasts and evaluations which subsequently turn out to be incorrect even though they were professionally justifiable on the basis of the information available at the time of verification. 13. Liability (1) cargo protection shall – on whatever legal grounds – only be liable for damage caused by it or its vicarious agents intentionally or with particularly gross negligence (krass grobe Fahrlässigkeit). Liability for slight negligence and for ordinary gross negligence is excluded to the extent permitted by law. This exclusion does not apply to personal injury or to claims under mandatory law (in particular the Austrian Product Liability Act). (2) In any event – except in the case of intent – liability is excluded for indirect damage, consequential damage, loss of profit, loss of production, frustrated expenses, reputational damage, loss of data outside the sphere of influence of cargo protection, loss of interest, contractual penalties owed by the customer to third parties, the rejection, reduction or refusal of insurance benefits vis-à-vis the customer, and for damage arising from claims of third parties against the customer. (3) In particular, cargo protection shall not – except in the case of intent – be liable for damage resulting from the fact that (a) a verified or rated transport company, despite a positive verification or favourable rating, acts in breach of contract, embezzles, misappropriates or damages cargo, becomes insolvent or has falsified its identity, (b) the customer makes a business decision on the basis of a Work Result, (c) Third-Party Sources supply incorrect, incomplete or outdated information, (d) automated or AI-based analysis procedures, despite careful development and quality assurance, make misclassifications or fail to detect cases of fraud and deception, or (e) Interfaces, external services or third-party providers within the meaning of Clause 8 fail, are disrupted or malfunction. (4) Insofar as liability exists in principle, it is limited per claim to the amount of the fee paid by the customer for the specific service giving rise to the damage, in the case of ongoing contracts to the annual fee paid by the customer in the last twelve months prior to the occurrence of the damage, but in total to EUR [amount, e.g. 50,000.00] per contract year. This limitation does not apply in the case of intent or to personal injury. (5) Claims for damages of the customer become time-barred within six months of knowledge of the damage and of the party causing the damage, and in any event within three years of the event giving rise to the claim. The customer must prove the existence of intent or particularly gross negligence; the reversal of the burden of proof under Section 1298 ABGB is – to the extent permissible – excluded. (6) The above limitations of liability also apply for the benefit of the officers, employees, vicarious agents and subcontractors of cargo protection. (7) Recourse claims within the meaning of Section 12 of the Austrian Product Liability Act are excluded unless the party entitled to recourse proves that the defect was caused within the sphere of cargo protection and was due to at least gross negligence. (8) For services provided free of charge (in particular trial access, free functions and voluntary additional services), cargo protection shall – to the extent permitted by law – only be liable in the case of intent. 14. Special Provisions for Consulting Services (1) Consulting services (in particular risk management consulting, load securing and loss prevention consulting) are provided in accordance with the principles of proper professional practice on the basis of the information provided by the customer. Recommendations are a basis for decision-making; their implementation is the responsibility of the customer. (2) The General Terms of Engagement for Management Consultants (Allgemeine Auftragsbedingungen für Unternehmensberater) of the Professional Group UBIT of the Austrian Economic Chambers (Wirtschaftskammer Österreich), as amended from time to time, shall apply additionally to consulting services, unless these GTC provide otherwise. 15. Special Provisions for Seminars and Training Courses (1) Registrations for seminars are binding. In the event of cancellation by the customer up to four weeks before the start of the event, no fee shall be charged; up to two weeks before the start, 50% of the participation fee shall be charged; thereafter and in the event of non- attendance, 100% of the participation fee shall be charged. A substitute participant may be named at any time. (2) cargo protection is entitled to cancel or postpone events for good cause (in particular illness of the speaker, insufficient number of participants, force majeure). In this case, participation fees already paid shall be refunded; there shall be no further claims (in particular for reimbursement of travel and cancellation costs). (3) Seminar content conveys general specialist knowledge and does not replace advice relating to the individual case. cargo protection assumes no liability for the application of the content conveyed in the participant’s business within the framework of Clause 13 (Liability). Training materials are protected by copyright and may neither be reproduced nor made accessible to third parties without consent. 16. Confidentiality (1) Both parties undertake to keep confidential information of the respective other party secret and to use it only for the purposes of performing the contract. This obligation shall continue for a period of three years after termination of the contract. (2) cargo protection is entitled to use data obtained in the course of providing the services in anonymised or aggregated form for statistical purposes, for the further development of its assessment models and for industry analyses. 17. Data Protection (1) The parties shall comply with the applicable data protection provisions (in particular the GDPR and the Austrian Data Protection Act – DSG). Insofar as cargo protection processes personal data on behalf of the customer, the parties shall conclude a separate data processing agreement pursuant to Art. 28 GDPR. Insofar as cargo protection processes personal data (e.g. concerning contact persons and responsible persons of verified transport companies) under its own responsibility, the privacy policy of cargo protection (https://cargo-protection.com/privacy) shall apply. (2) cargo protection uses sub-processors within the meaning of Art. 28(2) and (4) GDPR for data processing (in particular hosting and cloud providers, OCR, analysis and verification services, and data suppliers connected via Interfaces pursuant to Clause 8). These may also be established in third countries outside the EEA; in this case, cargo protection shall ensure appropriate safeguards pursuant to Art. 44 et seq. GDPR (in particular adequacy decisions or EU standard contractual clauses together with the necessary supplementary measures). The engagement or replacement of sub-processors shall be notified to the customer in accordance with the data processing agreement; the customer shall have the right to object provided for therein. (3) cargo protection is entitled to store verification processes, uploaded documents, OCR and analysis data, Work Results as well as technical processing and system logs within the scope of the business relationship and the statutory retention periods, in particular for the purposes of documentation and traceability of verifications carried out, security, support and error analysis, and the prevention of misuse and fraud. Furthermore, cargo protection is entitled to view content uploaded by the customer to the extent necessary insofar as this is required for support, error analysis, security purposes, the prevention of misuse or the fulfilment of statutory obligations. (4) The customer warrants that it is entitled to transmit the personal data provided by it to cargo protection and shall indemnify and hold cargo protection harmless with regard to claims of third parties arising from a breach of this warranty. 18. Force Majeure (1) Events of force majeure and other circumstances for which cargo protection is not responsible (in particular failure of Third-Party Sources, data suppliers or communication networks, measures taken by authorities, cyber attacks despite appropriate protective measures, strikes, pandemics) release cargo protection from its obligation to perform for as long as they persist and do not give rise to any claims for damages of the customer. If the impediment lasts longer than 60 days, both parties shall be entitled to withdraw from the contract with regard to the services not yet performed. 19. Set-off, Retention, Assignment (1) The customer may set off against claims of cargo protection only with counterclaims that have been established by a court or acknowledged in writing by cargo protection. Any right of retention of the customer is excluded to the extent permitted by law. The assignment of claims arising from the contract requires the written consent of cargo protection. 20. Final Provisions (1) Austrian substantive law shall apply, excluding the conflict-of-law rules of private international law and the UN Convention on Contracts for the International Sale of Goods (CISG). (2) The place of performance is the registered office of cargo protection. The exclusive place of jurisdiction for all disputes arising from or in connection with the contract is the court having subject-matter jurisdiction at the registered office of cargo protection ([e.g. Graz]). cargo protection is also entitled to sue the customer at the customer’s general place of jurisdiction. (3) Should individual provisions of these GTC be or become invalid or unenforceable in whole or in part, this shall not affect the validity of the remaining provisions. The invalid provision shall be replaced by a valid provision which comes closest to the economic purpose of the invalid provision. The same applies to any gaps in the contract. (4) The contract language is German. In the case of translations of these GTC, the German version shall be authoritative. The German version shall always be deemed the sole valid and legally binding version; this applies in particular in the event of any discrepancies, inconsistencies or differences in interpretation between the German version and this English translation. The English translation is provided for information purposes only. Errors in translation excepted.