General Terms and Conditions (AGB)

Alexander Lutsyuk – Arnika Plau, Dr. Alban Str. 24, 19395 Plau am See (hereinafter the “Provider”)

§ 1 Scope

(1) These General Terms and Conditions apply to all contracts between the Provider and the customer concerning IT security services, in particular forensic diagnoses, cleanup of compromised websites (e.g. removal of SEO spam, malware and backdoors), website hardening, and monitoring and protection services.

(2) Customers within the meaning of these Terms are both consumers (§ 13 BGB) and businesses (§ 14 BGB). A consumer is any natural person who enters into a legal transaction for purposes that are predominantly neither commercial nor their independent professional activity.

(3) Deviating, conflicting or supplementary terms of the customer become part of the contract only if the Provider has expressly agreed to their applicability in text form.

§ 2 Formation of contract

(1) Descriptions of services and packages on the Provider’s website do not constitute a legally binding offer, but an invitation for the customer to submit an offer.

(2) The contract is formed when the Provider accepts the customer’s order, usually by order confirmation by email or by commencing performance.

(3) Packages marked with “from” prices are guide prices. The final price is agreed individually as a fixed price before contract formation based on the forensic diagnosis or an audit.

§ 3 Scope of services

(1) The concrete scope of services follows from the order confirmation together with the relevant package description.

(2) Forensic diagnosis: In-depth analysis of the website, preparation of an evidence report and a containment plan. The fee for the diagnosis is fully credited against the cleanup price if cleanup is subsequently commissioned.

(3) Cleanup: Depending on the package, among other things removal of malware and backdoors, cleanup of spam URLs and database spam, identification and closure of the entry vector, sitemap repair, basic hardening, and preparation of a verification report. Cleanup is generator-based; the number of indexed spam URLs is not a price multiplier.

(4) Monitoring: Depending on the selected plan, among other things daily scans (malware, blacklist, uptime, spam patterns), alerts, security updates, manual reviews, reports, and WAF and log reviews.

(5) The Provider expressly points out:

a) Permanent, absolute protection against future attacks cannot be guaranteed despite hardening and monitoring.

b) Removal of spam URLs from search-engine indexes (e.g. Google) and restoration of rankings are outside the Provider’s control. After cleanup, search engines need their own time for re-crawling and de-indexing.

c) Removal of third-party blacklist entries will be requested; the decision rests with the respective blacklist operator.

(6) Changes and extensions of services require a separate agreement in text form.

§ 4 Customer cooperation duties

(1) The customer shall promptly provide the Provider with all access and information required for performance, in particular hosting/server access (FTP/SSH), CMS administrator access and — where required — access to Google Search Console.

(2) The customer warrants that they are the owner of the relevant domain/website or are authorized to commission the services.

(3) The customer remains responsible for regular backups of their data. Where technically reasonable, the Provider will create a backup before interventions if possible; completeness of that backup is not guaranteed.

(4) If the customer fails to meet or delays their cooperation duties, agreed performance deadlines are extended appropriately. Extra effort caused by missing or incomplete cooperation may be charged separately after prior notice.

§ 5 Prices and payment terms

(1) All prices are net plus statutory VAT (currently 19 %).

(2) Unless otherwise agreed, payment is generally due in advance (prepayment):

a) Forensic diagnosis: payable upon commissioning. Performance begins after receipt of payment;

b) Cleanup: payable upon order. Performance begins after receipt of payment;

c) Monitoring: payable monthly in advance, first payment upon contract formation.

(3) In case of default, statutory rules apply. For businesses the default interest rate is nine percentage points above the base rate; for consumers five percentage points above the base rate.

(4) The customer may set off only undisputed or finally adjudicated claims. A right of retention may be asserted only for counterclaims arising from the same contractual relationship.

§ 6 Term and termination (Monitoring)

(1) Monitoring contracts are concluded for an indefinite term and may be terminated by either party on 14 days’ notice to the end of a calendar month in text form (e.g. by email).

(2) The right to extraordinary termination for good cause remains unaffected.

(3) Under the “Pro” plan, one re-cleanup (re-infection) per contract year is included without additional charge, provided the re-infection is not due to intentional or grossly negligent conduct by the customer (e.g. disabling agreed protective measures, sharing credentials with third parties).

(4) Fees already paid for ongoing billing periods are not refunded pro rata upon ordinary termination, unless mandatory law provides otherwise.

§ 7 Right of withdrawal for consumers

Withdrawal information

Right of withdrawal

You have the right to withdraw from this contract within fourteen days without giving any reason. The withdrawal period is fourteen days from the day of the conclusion of the contract.

To exercise your right of withdrawal, you must inform us (Alexander Lutsyuk – Arnika Plau, Dr. Alban Str. 24, 19395 Plau am See, email: info@arnika-web.com, phone: +49 179 3949637) of your decision to withdraw from this contract by a clear statement (e.g. a letter sent by post or email). You may use the attached model withdrawal form, but it is not obligatory.

To meet the withdrawal deadline, it is sufficient for you to send your communication concerning your exercise of the right of withdrawal before the withdrawal period has expired.

Effects of withdrawal

If you withdraw from this contract, we shall reimburse to you all payments received from you, without undue delay and in any event not later than fourteen days from the day on which we are informed about your decision to withdraw. We will carry out such reimbursement using the same means of payment as you used for the initial transaction, unless you have expressly agreed otherwise; in any event, you will not incur any fees as a result of such reimbursement.

If you requested that the services begin during the withdrawal period, you shall pay us an amount which is in proportion to what has been provided until you have communicated your withdrawal from this contract, in comparison with the full coverage of the contract.

Premature expiry of the right of withdrawal

The right of withdrawal expires early for a contract for the provision of services if the Provider has fully performed the service and only began performance after the consumer gave express consent and simultaneously confirmed knowledge that they lose the right of withdrawal upon full performance by the Provider (§ 356 (4) BGB).

Model withdrawal form

(Complete and return this form only if you wish to withdraw from the contract.)

To:
Alexander Lutsyuk – Arnika Plau
Dr. Alban Str. 24
19395 Plau am See
Email: info@arnika-web.com

I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract for the provision of the following service (*):

Ordered on (*) / received on (*): ______________
Name of consumer(s): ______________
Address of consumer(s): ______________
Signature of consumer(s) (only if this form is notified on paper): ______________
Date: ______________

(*) Delete as appropriate.

§ 8 Warranty

(1) Statutory defect rights apply.

(2) Towards businesses, the limitation period for defect claims is one year from acceptance of the service. This does not apply in cases of intent, gross negligence, fraud, or injury to life, body or health.

(3) The Provider does not warrant the duration of de-indexing of spam URLs by search-engine operators (see § 3 (5)).

§ 9 Liability

(1) The Provider is liable without limitation for intent and gross negligence and for injury to life, body or health caused by negligent or intentional breach of duty by the Provider or its vicarious agents. Liability under the Product Liability Act remains unaffected.

(2) In case of slightly negligent breach of essential contractual duties (cardinal duties), liability is limited to the typical, foreseeable damage.

(3) Liability for slightly negligent breach of non-essential duties is excluded.

(4) Liability for loss of data is limited to the typical recovery effort that would have occurred even with regular, risk-appropriate backups.

(5) Where liability is excluded or limited, this also applies to the personal liability of employees, representatives and vicarious agents of the Provider.

§ 10 Data protection and processing on behalf

(1) The Provider processes the customer’s personal data solely for contract performance and in accordance with its privacy policy.

(2) Where the Provider obtains access to personal data that the customer processes as controller (e.g. user data in the customer database), a data-processing agreement under Art. 28 GDPR will be concluded at the customer’s request.

(3) Credentials provided by the customer are used solely for contract performance, treated confidentially, and deleted after completion of the engagement or the customer is advised to change them.

§ 11 Confidentiality

(1) Both parties undertake to treat as confidential all confidential information of the other party learned in connection with contract performance — in particular credentials, technical infrastructure details and findings from forensic investigations — and not to disclose them to third parties.

(2) This obligation continues after the end of the contractual relationship. Excluded is information that is publicly known or that must be disclosed due to legal obligation.

§ 12 Final provisions

(1) The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). Towards consumers, this choice of law applies only to the extent that mandatory protective provisions of the law of the state of the consumer’s habitual residence are not withdrawn.

(2) If the customer is a merchant, a legal entity under public law or a special fund under public law, the exclusive place of jurisdiction for all disputes arising from this contract is the Provider’s place of business.

(3) Amendments and supplements to this contract require text form. This also applies to amendment of this clause.

(4) If individual provisions of these Terms are or become wholly or partly invalid, the validity of the remaining provisions is not affected. The invalid provision is replaced by the statutory rule.

Last updated: August 2026