Version 2.2 – as of 25 October 2026
This English version is a convenience translation. In the event of any discrepancy, the German version shall prevail.
1.1 These GTC apply to all contracts for the use of the software-as-a-service applications “Tenderhub” and “PlanReader” (each hereinafter “Platform” or “Service”) between revitalyze FlexCo, Mühltal 43, 6341 Ebbs, Austria, VAT ID ATU80541503 (hereinafter “revitalyze”), and the customer. Tenderhub and PlanReader are stand-alone applications that are operated and ordered separately; which application the customer uses follows from the offer, the individual contract, the trial terms or the registration. Provisions that concern only one of the two applications are marked accordingly.
1.2 The Platform is aimed exclusively at entrepreneurs within the meaning of § 1 of the Austrian Commercial Code (UGB) and at legal entities under public law. No contracts are concluded with consumers within the meaning of the Austrian Consumer Protection Act (KSchG). By registering or ordering, the customer confirms that it is acting as an entrepreneur.
1.3 General terms and conditions or purchasing conditions of the customer do not become part of the contract, even if revitalyze does not expressly object to them. They apply only if revitalyze expressly agrees to them in text form.
2.1 The contract is concluded by acceptance of an offer from revitalyze, by signing an individual contract or by completing online registration.
2.2 The following form part of the contract, in the following order of precedence in the event of conflict:
The individual contract, the DPA and these GTC together form the “Main Contract”.
2.3 Trial accounts and pilot phases are agreed separately, for example in trial terms that revitalyze publishes at revitalyze.io/terms. Unless otherwise agreed there, these GTC also apply to them.
2.4 The free initial analysis of tender documents that revitalyze offers through a form on revitalyze.io (free analysis) is a service provided free of charge, in the scope stated there and once per company. There is no entitlement to it; revitalyze may decline a request without giving reasons. Clauses 1, 3.4, 4, 5, 6, 9, 11 (in particular clause 11.6), 12, 13 and 17 apply to the free analysis accordingly; clause 10 does not apply. revitalyze provides the Results by e-mail or through a time-limited download and deletes the uploaded documents as soon as they are no longer required for the request (see the privacy policy at revitalyze.io/privacy).
3.1 revitalyze offers two AI-supported applications for the construction industry:
Tenderhub and PlanReader are operated separately. Transferring data or Results from one application to the other is not part of the service.
3.2 revitalyze operates the Platform in data centres within the EU, where Customer Data is also stored. For the AI functions, revitalyze uses AI services of third-party providers acting as sub-processors. The customer acknowledges and agrees that inputs and results may also be processed in third countries, in particular in the USA. By separate agreement, revitalyze restricts AI processing to data centres in the EU and the EFTA states, insofar as the respective function is available there. If the customer uses the optional web search in the chat, only the search queries are transmitted to an external search service, which processes them as an independent controller; files and chat histories are not transmitted. The sub-processors, the processing locations and the safeguards for transfers to third countries are governed by the DPA; clause 5 of the DPA applies to the engagement or replacement of sub-processors.
3.3 The specific scope of functions and services is governed by the offer or individual contract. Public statements, presentations or marketing materials do not constitute warranted characteristics unless expressly included in the individual contract.
3.4 revitalyze does not provide legal, tax, engineering, expert-witness or estimating services. In particular, revitalyze does not perform estimating, does not prepare bids, does not provide warranted quantity takeoffs and does not review documents in the capacity of an expert. Indications by the Platform on contract conditions, risks or potential claims do not constitute legal advice and do not replace an assessment by a lawyer or another person authorised to provide it. Quantities determined by PlanReader are not a verified quantity takeoff and do not replace review by the customer’s qualified personnel (clause 4.2).
4.1 The results of the Platform, such as extractions, quantities, building elements detected and drawn on plans, summaries, notes on risks and contradictions or answers of the chat and the plan assistant (hereinafter “Results”), are generated automatically using AI models, in particular language and vision models. Such models work on the basis of probabilities. Results may therefore be incomplete, inaccurate or incorrect, even if the Platform is functioning properly. This applies in particular where the source documents are incomplete, contradictory or poorly legible.
4.2 The Results serve exclusively as a working aid and decision support. Before the customer uses Results for estimates, bids, pricing, bidding decisions, claims for additional payment, award or contract decisions, it shall have them reviewed by qualified personnel against the original documents and approve them. Review, correction, approval and use of the Results are the sole responsibility of the customer.
4.3 Where the Platform provides source references (e.g. page or plan references), uncertainty notices or approval functions, the customer uses them for its review. An approval in the Platform documents the review by the customer.
4.4 revitalyze gives no warranty that the Results are complete and correct or suitable for a particular purpose. Nor does revitalyze guarantee any particular economic success, such as winning a contract, estimating accuracy or the enforceability of claims for additional payment.
5.1 revitalyze is the provider of the AI systems Tenderhub and PlanReader; the customer is the deployer within the meaning of Regulation (EU) 2024/1689 (AI Act). In revitalyze’s assessment, Tenderhub and PlanReader are not high-risk AI systems within the meaning of Art 6 in conjunction with Annexes I and III of the AI Act.
5.2 Transparency (Art 50 AI Act): revitalyze designs the Platform so that users can recognise that they are interacting with an AI system, and labels AI-generated Results as such to the extent Art 50 AI Act requires.
5.3 The customer does not remove or alter the AI labelling insofar as it passes on the Results unchanged to third parties and those third parties need the labelling for classification. As deployer, the customer has its own obligations under the AI Act, in particular under Art 50(4). It fulfils these on its own responsibility.
5.4 AI literacy (Art 4 AI Act): The customer ensures that its users have sufficient AI literacy to assess the Results appropriately. revitalyze provides usage guidance for this purpose and, on request, an introduction.
5.5 Prohibited uses: The customer does not use the Platform for purposes that are prohibited under Art 5 AI Act or that would constitute a high-risk AI system under Annex III. These include in particular the assessment, selection or monitoring of natural persons, for example applicants, employees or subcontractors who are natural persons, as well as credit assessments of natural persons. If the customer nevertheless uses the Platform in this way, it bears the associated obligations itself (Art 25 AI Act) and indemnifies and holds revitalyze harmless.
6.1 The customer is solely responsible for the content, lawfulness and accuracy of the uploaded documents and data (hereinafter “Customer Data”). It warrants that it is entitled to upload and process the Customer Data and does not thereby infringe any third-party rights, in particular no copyright, secrecy or confidentiality obligations towards clients or planners.
6.2 The customer uploads personal data only to the extent necessary for analysing the documents. Typically these are names and contact details of contact persons and project participants. The customer is the controller in terms of data protection law for this data. The customer does not upload special categories of personal data within the meaning of Art 9 GDPR or data relating to criminal convictions (Art 10 GDPR).
6.3 The customer keeps access credentials secret and protects them against access by third parties. It restricts access to authorised persons and informs revitalyze without delay if it suspects misuse. The customer is responsible for actions carried out through its accounts insofar as it is responsible for the misuse.
6.4 The customer refrains from any use that impairs the Platform, its security or other customers. This includes in particular attacks, circumventing security mechanisms, automated mass queries outside agreed interfaces, reverse engineering (unless mandatorily permitted by law) and uploading malware.
6.5 The customer indemnifies and holds revitalyze harmless if third parties assert claims because the customer has breached clauses 5.5, 6.1, 6.2 or 6.4. This also covers reasonable costs of legal defence. This requires that revitalyze informs the customer without delay and enables it to defend against the claims.
6.6 The customer backs up Results it needs permanently on its own responsibility, for example by exporting or downloading them. In Tenderhub, files created by the chat are deleted automatically once no new message has been written in the respective chat for 30 days; the chat messages themselves are kept. If the customer deletes a message, a chat or a project, the associated files are deleted immediately.
7.1 revitalyze provides the Platform with the care customary in the industry. revitalyze owes a specific availability level (SLA) only if it is expressly agreed in the individual contract.
7.2 revitalyze carries out planned maintenance outside normal business hours where possible and announces it in good time. revitalyze may also carry out necessary security measures without prior notice.
7.3 revitalyze continuously develops the Platform and may change, replace or discontinue functions insofar as this is reasonable for the customer and the contractually agreed core of the service is not materially restricted. If a contractually agreed function is materially restricted, the customer may terminate the contract extraordinarily with effect from the time of the change.
7.4 revitalyze is not liable for disruptions outside its sphere of influence, such as the internet or the customer’s systems, nor for events of force majeure. Disruptions of the infrastructure used by revitalyze are governed by clause 11.
8.1 The fees result from the offer or individual contract. All prices are net plus statutory VAT.
8.2 Unless otherwise agreed, invoices are due for payment without deduction within 14 days of the invoice date. In the event of late payment, the statutory default interest for commercial transactions applies (§ 456 UGB).
8.3 If the customer is more than 30 days in arrears with a due payment, revitalyze may block access after a prior reminder threatening suspension and a grace period of 14 days. The payment obligation remains unaffected.
8.4 The customer may set off against revitalyze’s claims only counterclaims that revitalyze has acknowledged in text form or that have been established by a final and binding decision. The same applies to withholding payments, including on account of defects.
9.1 Insofar as revitalyze processes personal data on behalf of the customer when the Platform is used, revitalyze is a processor under Art 28 GDPR and the customer is the controller. The details are governed by the DPA. It covers in particular the technical and organisational measures, sub-processors, processing locations, notification of personal data breaches and deletion.
9.2 revitalyze uses Customer Data exclusively to provide the contractual services to the customer, including the quality assurance governed by the DPA. Customer Data is neither sold nor rented, and it is not used for training, fine-tuning or further development of own or third-party AI models.
9.3 revitalyze may evaluate technical operating and usage data without content of Customer Data, such as run times, error rates or feature usage, exclusively in anonymised form that does not allow conclusions to be drawn about users, the customer or the content of Customer Data, for the operation, security and improvement of the Platform.
9.4 Insofar as revitalyze processes personal data as an independent controller, for example for user accounts and sign-in, the security of the Platform, contract handling, billing and communication with users and the customer’s contact persons, the privacy policy at revitalyze.io/privacy provides information on this.
10.1 revitalyze warrants that the Platform essentially corresponds to the agreed service description. It is not a defect if individual AI Results are inaccurate or incomplete (clause 4.1). However, it is a defect if the Platform deviates systematically, reproducibly and significantly from the service description.
10.2 The customer reports defects without delay, at the latest within 14 days of becoming aware of them, in text form and with a comprehensible description. revitalyze remedies reported defects within a reasonable period, at its own discretion by improvement, workaround or replacement.
10.3 If the remedy of defects finally fails, the customer may demand an appropriate reduction of the fee or, in the case of material defects, terminate the contract extraordinarily.
10.4 Rescission on the grounds of laesio enormis (§ 934 ABGB) is excluded. The presumption of defectiveness under § 924 ABGB does not apply.
11.1 revitalyze is liable without limitation
11.2 Otherwise, revitalyze’s liability for slight negligence is excluded.
11.3 Except in the cases of clause 11.1, revitalyze’s liability for gross negligence per damage event and in total per contract year is limited to the amount the customer owed to revitalyze for the twelve months preceding the event giving rise to the damage (liability cap). If the contract has existed for less than twelve months, the agreed fee extrapolated to twelve months applies.
11.4 Except in the cases of clause 11.1, revitalyze is not liable for
11.5 Except in the cases of clause 11.1, revitalyze is liable for loss of data only in the amount of the effort that would have been required for restoration had the customer backed up its data properly (clause 6.6). revitalyze’s obligations under the DPA remain unaffected.
11.6 In the case of use free of charge (e.g. trial account, free pilot), revitalyze is liable only in the cases of clause 11.1.
11.7 The customer must prove the damage and revitalyze’s fault; § 1298 ABGB (reversal of the burden of proof) is waived to that extent. Claims for damages become time-barred one year after knowledge of the damage and the party causing it, but no later than three years after the event giving rise to the damage. Neither applies to personal injury, to claims based on intent or in the cases of clause 11.1(d).
11.8 The limitations of liability also apply in favour of revitalyze’s corporate bodies, employees and vicarious agents. Liability towards data subjects under Art 82 GDPR remains unaffected. In the relationship between the parties, this clause 11 also applies to claims under the DPA.
12.1 All rights in the Platform, the software, the prompts, model configurations and documentation remain with revitalyze or its licensors. For the term of the contract, the customer receives a non-exclusive, non-transferable right to use the Platform to the agreed extent for its own business purposes.
12.2 Customer Data remains the property of the customer. The customer grants revitalyze the right, limited in time to the term of the contract, to process the Customer Data exclusively for the provision of the services.
12.3 The Results are at the customer’s free disposal to the extent that rights arise in them. Third-party rights in the underlying documents remain unaffected.
13.1 The parties treat as confidential all non-public information of the other party that becomes known to them in the context of the contract. They protect it with at least the same care as their own confidential information. The customer’s tender and estimating documents and plans are always deemed confidential.
13.2 The obligation does not apply to information that is demonstrably publicly known, was already lawfully known to the receiving party or must be disclosed because a law, court or authority requires it.
13.3 The confidentiality obligation continues after the end of the contract.
13.4 Notwithstanding clause 13.1, during the term of a paid contract revitalyze may name the customer as a reference, using its company name and logo, in particular on revitalyze’s website and in presentations. If the customer objects in text form or the contract ends, revitalyze removes the reference within 30 days; materials already distributed are not affected.
14.1 The term and notice periods result from the individual contract or offer. If nothing is agreed there, the contract runs for an indefinite period. It may then be terminated by either party in text form with one month’s notice to the end of the respective billing period.
14.2 The right to extraordinary termination for good cause remains unaffected. Good cause for revitalyze exists in particular if, despite a reminder, the customer is in arrears with more than two monthly fees or seriously breaches clauses 5.5 or 6.
14.3 revitalyze may temporarily block access if there is a significant risk to the security of the Platform or to data of other customers, in the event of serious breaches of clauses 5.5 or 6, or where there are concrete indications of misuse of the customer’s access (clauses 6.3 and 6.4). The suspension is limited to what is necessary, for example to individual users or functions. revitalyze informs the customer of the suspension and its reason without delay and lifts it as soon as the reason no longer applies. The customer’s payment obligation remains in place insofar as it is responsible for the suspension.
14.4 If the customer makes a switching request under clause 15.1 together with its notice of termination, it may terminate the contract in text form with two months’ notice, even if clause 14.1 or the individual contract provides for a longer notice period, a later termination date, a fixed term or a minimum term (Art 25(2)(d) Data Act). If the contract thereby ends before the agreed term or the current billing period expires, the customer owes an early termination fee for the remaining period. It equals the fees agreed for that period less the expenses that revitalyze saves as a result of the early termination, in particular usage-based costs for AI services and cloud infrastructure. Fees paid in advance are credited and any surplus is refunded; otherwise, the fee falls due at the end of the contract. This fee is not a fee for switching, export or deletion (clause 15.6). No further claims arise from the early termination.
15.1 This clause governs switching to another provider or to the customer’s own IT systems, the export of the customer’s data and its deletion under Chapter VI of Regulation (EU) 2023/2854 (Data Act). With its notice of termination, or later during the notice period, the customer may request in text form (switching request)
The customer may also combine these options.
15.2 Switching or export takes place without undue delay within a transitional period of no more than 30 calendar days, which begins when the notice period ends. The contract continues to apply during the transitional period, and revitalyze
If the transitional period of 30 calendar days is technically unfeasible, revitalyze notifies the customer within 14 working days of the switching request, gives its reasons and names an alternative transitional period of no more than seven months; the services continue during this period as well. The customer may extend the transitional period once by a period it considers more appropriate for its own purposes.
15.3 The transitional period is followed by a retrieval period of 30 calendar days, unless a longer period has been agreed. During this time the customer can continue to retrieve its exportable data; revitalyze provides them on request.
15.4 Exportable data are all input and output data, including metadata, generated directly or indirectly by the customer’s use of the Platform, except for the data listed in clause 15.5. In detail, where available, these are:
This list is also the online register of exportable data and data formats under Art 26(b) Data Act. revitalyze keeps it up to date at revitalyze.io/terms and may extend it at any time with further exportable data or formats; this is not an amendment of these GTC under clause 16. Exports on request are provided in a structured, commonly used and machine-readable format; revitalyze describes the structure of these exports to the customer when providing them.
15.5 Only the following data are not exportable, as they relate to the internal functioning of the Platform and their disclosure would breach revitalyze’s trade secrets:
These exceptions do not impede or delay switching.
15.6 revitalyze charges no fees for switching, export or deletion. The agreed fees for the services that revitalyze continues to provide during the transitional period remain unaffected.
15.7 The contract ends when switching has been completed successfully; if the customer only requests deletion, it ends when the notice period ends. revitalyze notifies the customer of the end of the contract in text form. After the retrieval period ends or, in the case of deletion only, when the notice period ends, revitalyze completely deletes all exportable data and digital assets generated directly by the customer or relating directly to the customer. If the customer makes no switching request, it can export its exportable data itself until the end of the contract and request their handover in text form within 30 calendar days after the end of the contract; revitalyze then deletes the Customer Data without undue delay after the handover or, without such a request, no later than 30 calendar days after the end of the contract. revitalyze confirms the deletion in text form. Backups that still contain these data are overwritten in the regular cycle and deleted no later than 60 days after the deletion. The DPA continues to apply until the data have been completely handed over and deleted.
15.8 revitalyze supports the customer’s exit strategy and provides all relevant information for it, in particular on the available procedures, methods and formats for switching and export and on known restrictions and technical limitations. revitalyze provides data that are exported on request under clause 15.4 within 14 days of the request. The customer may also request exports under clause 15.4 during the term of the contract and independently of a termination, for example to use services of several providers in parallel. Files created by the chat are only available until they are deleted automatically under clause 6.6.
15.9 Information under Art 28 Data Act: The IT infrastructure of Tenderhub and PlanReader is located in Microsoft Azure data centres in Germany and Sweden and is subject to the law of the EU and of these Member States. The provider is Microsoft Ireland Operations Ltd. (Ireland), a company of the Microsoft group whose parent company is based in the USA. Providers that revitalyze uses for the AI functions may also process data in third countries, in particular in the USA, and are to that extent also subject to the law of those countries (clause 3.2 and Annex ./2 of the DPA). revitalyze has taken the following measures against governmental access from third countries that would conflict with Union law or the law of a Member State: the data are encrypted at rest and in transit. revitalyze only uses providers that have contractually committed to review official disclosure requests for their lawfulness, to challenge unlawful requests and to inform revitalyze of such requests where legally permitted. revitalyze informs the customer of official disclosure requests without undue delay, where legally permitted, and refers the authority to the customer (clause 3 (1) of the DPA). revitalyze keeps this information up to date at revitalyze.io/terms.
16.1 revitalyze may amend these GTC if there are objective reasons, in particular changes in legislation, case law, regulatory requirements, changes to the AI Act or changed technical conditions. The main performance obligations and the balance between performance and consideration are not changed to the customer’s disadvantage in this way.
16.2 revitalyze notifies the customer of amendments in text form at least six weeks before they take effect and contrasts the amended provisions. If the customer does not object in text form by the time they take effect, the amendments are deemed approved. revitalyze points out this consequence and the right to object separately in the notification.
16.3 If the customer objects, the contract continues under the previous terms. Either party may then terminate it with one month’s notice to the end of the month.
17.1 Austrian law applies, excluding the conflict-of-law rules of private international law and the UN Convention on Contracts for the International Sale of Goods.
17.2 The exclusive place of jurisdiction for all disputes arising from or in connection with this contract is the court with subject-matter jurisdiction for Innsbruck. revitalyze is also entitled to sue the customer at its general place of jurisdiction.
17.3 Declarations under this contract require text form (e.g. e-mail), unless otherwise stipulated. There are no oral side agreements.
17.4 The customer may transfer rights and obligations under this contract to third parties only with the prior consent of revitalyze in text form.
17.5 If any provision of these GTC is wholly or partly invalid, the remaining provisions remain valid. The invalid provision is replaced by the valid provision that comes closest to the economic purpose of the invalid provision.
Contact: revitalyze FlexCo, Mühltal 43, 6341 Ebbs, Austria · info@revitalyze.io · Data protection enquiries: info@revitalyze.io
Version 2.2 – as of 25 October 2026
between
revitalyze FlexCo
Mühltal 43
6341 Ebbs, Austria
(hereinafter referred to as Processor)
&
the customer under the Main Contract (user of the “Tenderhub” and/or “PlanReader” application)
(hereinafter referred to as Controller)
(1) The subject matter of this agreement is the performance of the following tasks:
The provision of services, in particular the provision and operation of the Software-as-a-Service applications “Tenderhub” (AI-assisted analysis of tender and contract documents) and “PlanReader” (AI-assisted quantity takeoff from plans). Both applications are operated separately; this agreement applies to the application used by the Controller (hereinafter the “Platform”).
This agreement supplements the General Terms and Conditions of revitalyze FlexCo for the use of “Tenderhub” and “PlanReader” in the version agreed with the Controller (currently Version 2.2) and the respective individual contract or accepted offer (together the “Main Contract”). In the event of contradictions, the provisions of this agreement take precedence over the Main Contract in matters of data protection.
(2) The following data categories are processed:
The Processor processes the names, email addresses and login data of users for managing user accounts, sign-in, the security of the Platform, contract handling and communication with users as an independent controller (clause 9.4 of the GTC); this agreement does not apply to that extent.
(3) The following categories of data subjects are subject to processing:
(4) Type of processing:
Processing includes the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure (within the scope of contractual services), alignment or combination, as well as deletion or destruction of data.
The term of this agreement corresponds to the term of the Main Contract for the use of Tenderhub or PlanReader. It ends upon termination of the Main Contract but continues to apply until the Processor has handed over and deleted all data of the Controller in accordance with clause 3 (7). Separate ordinary termination of this agreement is excluded.
(1) The Processor processes data and processing results exclusively within the framework of the documented instructions of the Controller (Art. 28 (3) (a) GDPR). The instructions initially follow from the Main Contract and this agreement as well as from the Controller’s use of the Platform; further instructions are issued by the Controller in text form. If the Processor receives an official order to release data of the Controller, they shall - if legally permissible - immediately inform the Controller and refer the authority to them. Data is not processed for the Processor's own purposes.
(2) The Processor legally declares that they have taken all necessary measures to ensure the security of processing in accordance with Art. 32 GDPR (details can be found in Annex /1).
(3) The Processor takes technical and organizational measures so that the Controller can fulfill the rights of the data subject under Chapter III of the GDPR (information, access, rectification and erasure, data portability, objection, and automated individual decision-making) within the legal deadlines at all times and provides the Controller with all necessary information. If a corresponding request is addressed to the Processor and it is evident that the applicant mistakenly considers them to be the Controller of the data processing they operate, the Processor must immediately forward the request to the Controller and inform the applicant accordingly.
(4) The Processor supports the Controller in complying with the obligations set out in Articles 32 to 36 GDPR (data security measures, notifications of personal data breaches to the supervisory authority, notification of the data subject affected by a personal data breach, data protection impact assessment, prior consultation). In the event of a personal data breach, the Processor reports it to the Controller without undue delay, but no later than 24 hours after becoming aware of it, and provides the information pursuant to Art. 33 (3) GDPR insofar as it is available; missing information is provided without undue delay.
(5) The Processor maintains a record of processing activities pursuant to Art. 30 (2) GDPR for the present processing.
(6) With regard to the processing of the data provided by it, the Controller is granted the right to inspect and control the data processing facilities, including through third parties commissioned by it. The Processor undertakes to provide the Controller with the information necessary to verify compliance with the obligations set out in this agreement.
Audits are carried out exclusively during normal business hours and require timely notice with a reasonable period, for example 14 days. Insofar as audits go beyond the legally mandatory extent, the costs incurred are borne by the Controller. In any case, the protection of trade secrets and of other customers’ data must be ensured; direct access to the servers is therefore excluded.
(7) Handover and deletion of the data after termination of the Main Contract are governed by clause 15 of the GTC. The Processor confirms the deletion in text form without being asked. Backups that still contain these data are overwritten in the regular cycle and deleted no later than 60 days after the deletion; log and telemetry data are deleted automatically after 90 days. Files created by the chat in Tenderhub that have already been deleted under clause 6.6 of the GTC are not covered by the handover. If the Processor processes the data in a special technical format, it hands them over, at the Controller’s choice, in that format, in the format in which it received them from the Controller or in another common format.
(8) The Processor must immediately inform the Controller if they believe that an instruction from the Controller violates data protection provisions of the Union or the Member States.
(9) Confidentiality: The Processor ensures that all employees and other persons authorised to process the personal data have committed themselves to confidentiality in writing in advance or are subject to an appropriate statutory obligation of confidentiality (Art. 28 (3) (b) GDPR). This obligation continues after the end of the order.
(10) Exclusion of AI training: The Processor contractually and bindingly warrants that the Controller’s content and data will at no time be used for training, fine-tuning or further development of its own or third-party artificial intelligence (AI) or language models (LLMs).
(11) AI services: For the AI functions of the Platform, the Processor uses AI services of sub-processors (Annex ./2). Inputs and results may also be processed in third countries, in particular in the USA (clause 4). If the Controller has agreed that AI processing is restricted to the EU and the EFTA states, AI processing takes place in data centres in these states, insofar as the respective function is available there. Web search in the Tenderhub chat is optional and only active if a user switches it on. When it is active, only the search queries are transmitted to Microsoft’s “Grounding with Bing Search” service, no files and no chat histories. Microsoft processes these search queries as an independent controller under the Grounding with Bing terms of use and the Microsoft Privacy Statement; Microsoft’s data protection terms for Azure do not apply in this respect, and the processing is not limited to the EU. To that extent, Microsoft is not a sub-processor of the Processor. Other or further AI providers are only engaged in accordance with the procedure under clause 5.
(12) Quality assurance on behalf of the Controller: Quality assurance of the analysis results is part of the commissioned service and is carried out exclusively for the provision and troubleshooting of the service to the Controller. It is based primarily on anonymised technical metadata. Individual analysis results are only viewed insofar as this is necessary for error analysis, by a designated group of persons bound to confidentiality (founding team), on a need-to-know basis and with logging. No processing takes place for the Processor’s own purposes. The Controller may object to individual analysis results being viewed at any time in text form; support access then only takes place at the Controller’s express request.
The Processor stores the data in data centres within the European Union (EU), currently in Germany and Sweden. For the AI functions, inputs and results may also be processed in third countries, in particular in the USA; the Controller acknowledges and agrees to this. Clause 3 (11) applies to an agreed restriction of AI processing to the EU and the EFTA states and to the optional web search in the chat.
The Processor ensures that the requirements of Art. 44 ff. GDPR are met for transfers to third countries, in particular through an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for recipients certified under it, or through EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The basis for each sub-processor is stated in Annex ./2.
The Processor may engage sub-processors. By concluding this agreement, the Controller approves the sub-processors listed in Annex ./2. The Processor notifies the Controller of intended changes concerning the addition or replacement of sub-processors at least 30 days in advance in text form (e.g. e-mail). The use of further services of a sub-processor listed in Annex ./2 within the scope described there is not such a change. The Processor contractually binds each sub-processor to data protection obligations equivalent to those set out in this agreement (Art. 28 (4) GDPR). The Controller has a right to object to such changes for important reasons of data protection law; the objection must be made in text form within 30 days of receipt of the notification. If the Processor cannot provide the service without the new sub-processor and the Controller maintains its objection, both parties have a special right to terminate the Main Contract.
(1) The liability of the parties towards each other is governed by the liability provisions of the Main Contract (clause 11 of the GTC), including the liability cap agreed there.
(2) Liability towards data subjects under Art. 82 GDPR and responsibility towards supervisory authorities remain unaffected.
(1) Austrian law applies, excluding the conflict-of-law rules of private international law and the UN Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction is the court with subject-matter jurisdiction for Innsbruck.
(2) Amendments and additions to this agreement require text form. Should a provision be invalid, the validity of the remaining provisions remains unaffected.
Physical Access Control: Protection against unauthorized access to data processing systems through:
System Access Control: Protection against unauthorized system use through:
Data Access Control: No unauthorized reading, copying, modifying, or removing within the system through:
Separation Control (Tenant Separation): Separate processing of different customers’ data through:
Transfer Control: No unauthorized reading, copying, modifying, or removing during electronic transmission or transport through:
Input Control: Traceability of inputs into the Platform through:
Availability Control: Protection against accidental or intentional destruction or loss through:
Recoverability: Timely restoration of the availability of and access to the data in the event of an incident through:
Order Control: No order data processing within the meaning of Art. 28 GDPR without corresponding instruction from the Controller through:
| Provider | Purpose | Location | Legal basis for third-country transfer |
|---|---|---|---|
| Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Cloud services (Microsoft Azure, Microsoft 365): operation of the Platform, storage and backup of the data, e-mail delivery, AI processing | Storage in the EU (currently Germany and Sweden); processing by individual services, such as AI processing, also possible in third countries such as the USA | EU-U.S. Data Privacy Framework (Microsoft certified); alternatively EU Standard Contractual Clauses (SCC) |
| Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland | AI processing | Processing possible worldwide, in particular in the USA | EU Standard Contractual Clauses (SCC) |
List as of 25 October 2026.
Version 2026-10-25 – as of 25 October 2026
This English version is a convenience translation. In the event of any discrepancy, the German version shall prevail.
1.1 These Trial Terms govern the free trial of “PlanReader” (hereinafter the “Trial”) between revitalyze FlexCo, Mühltal 43, 6341 Ebbs, Austria (hereinafter “revitalyze”), and the company for which the Trial is requested (hereinafter the “Customer”). They are a separate agreement within the meaning of clause 2.3 of revitalyze’s General Terms and Conditions (hereinafter the “GTC”) and take precedence over them. In all other respects, the GTC and the data processing agreement (DPA) apply; both are available at revitalyze.io/terms.
1.2 The Trial is open only to entrepreneurs and legal entities under public law (clause 1.2 of the GTC). By submitting the request, the person submitting it confirms that the Customer is acting as an entrepreneur and that they are authorised to represent it.
2.1 By submitting the request, the Customer offers to conclude the contract for the Trial; the confirmation of receipt is not an acceptance. revitalyze accepts the offer by sending the invitation to the Trial. It is not obliged to do so and need neither communicate nor give reasons for a rejection. The Trial is granted to each Customer at most once.
3.1 For the Customer as a whole, the Trial comprises only the AI-assisted analysis of one plan (one PDF page) and four messages to the plan assistant (hereinafter the “Allowance”). PlanReader’s count is authoritative for the use of the Allowance.
3.2 The Trial is free of charge. revitalyze provides PlanReader in its current state of development and owes neither particular functions nor any particular availability or processing time; clause 7 of the GTC does not apply.
4.1 revitalyze gives no warranty for the Trial; clause 10 of the GTC does not apply. It is liable only in cases of intent and of gross negligence of a particularly serious nature, for personal injury and insofar as mandatory law does not permit a limitation (clauses 11.1 and 11.6 of the GTC).
5.1 The contract for the Trial runs for an indefinite period. Either party may terminate it in text form at any time, without notice and without giving reasons. revitalyze may restrict or block access at any time. Clauses 14.1 and 14.3 of the GTC do not apply.
5.2 If the parties subsequently conclude a paid contract for PlanReader, the Customer Data and Results of the Trial are retained.