The terms we work on

These Terms of Service (“Terms”) govern all services of FLORIS³ GmbH, Salzgries 21/16, 1010 Vienna, Austria, FN 544762x, Commercial Court Vienna (“FLORIS³”, “we”, “us”) to its clients (“Client”, “you”).

Our services are offered exclusively to businesses within the meaning of § 1 of the Austrian Consumer Protection Act (KSchG). By entering into an agreement, the person accepting confirms that they are authorised to bind the Client and that the Client is not a consumer.

The agreement consists of the following documents; in case of conflict, the earlier one prevails:

1. the signed offer or order form, including any DORA addendum;
2. the Service Level Agreement;
3. the data processing agreement in section 13;
4. these Terms;
5. the prices and commercial terms published on /pricing at the date of the order.

The Client’s own general terms and conditions do not apply, even if we do not object to them or perform without reservation.

FLORIS³ provides infrastructure and support to bring investment offerings to market. Depending on the order, this includes:

• Capital Blueprint — a fixed-fee structuring engagement that defines the funding model, instrument, jurisdiction and filing route.
• Filing Package — preparation of investor onboarding, provider contracts and the document set up to submission to the competent authority.
• Issuer and Distribution Programmes — the platform (client application, investor portal on your domain, register and cap-table administration, distributions, and for Distribution: intermediary tenants, commission settlement, CRM and reporting), guided onboarding and a named contact.
• Dedicated Environment — operation of your programme in its own AWS environment with own keys, EU residency, its own release ring and the committed service levels in the SLA.
• Network licence — the network layer for operators running several client companies.
• Professional services — additional consulting at the published day rates.

The scope, volumes (concurrent offerings, investor subscriptions, intermediary tenants, seats) and prices of each service are those in the order and on /pricing. The platform technology is developed and operated with FinFortus GmbH, Salzgries 21/16, 1010 Vienna, which acts as our subcontractor.

• We do not hold client or investor money, execute orders, or offer, place or sell instruments to investors.
• We do not give legal, tax or investment advice. Templates, checklists and Blueprint deliverables are the basis for your decisions and your advisers’ review; they do not replace legal advice. Legal opinions and documents are provided by independent law firms under their own engagement.
• Register keeping (for example under the German eWpG), crypto custody, identity verification, payment services and, on Distribution, the licensed partner framework for advisers are provided by licensed third parties that we name in your offer. We coordinate them; each acts under its own licence and terms.
• We do not guarantee fundraising success, investor demand, regulatory approval, liquidity, secondary-market listing or investment performance.

Investors are your customers. They use the investor portal under your terms and privacy notice. No contract arises between FLORIS³ and your investors, except where a third-party provider requires its own terms.

You are responsible, at your own expense, for:

• the legal structure of each offering, the choice of jurisdictions and exemptions, and compliance with capital-markets, prospectus, anti-money-laundering, MiCA, securities, tax, marketing and data-protection law;
• obtaining and keeping all licences, approvals, prospectuses, information sheets and legal opinions required for your offerings;
• the accuracy and completeness of everything you provide or publish, and its clearance by your advisers;
• accepting or rejecting investors — the AML and suitability decision is yours, even where our platform prepares it;
• providing the Blueprint checklist inputs and approvals on the agreed dates;
• keeping credentials, API keys and signing keys confidential, managing your users and removing access that is no longer needed;
• checking wallet addresses and amounts before any on-chain action;
• reporting defects promptly with the information needed to reproduce them.

You confirm that you, your beneficial owners and your directors are not subject to EU, UN, UK or US sanctions and are not insolvent, and you will tell us promptly if this changes.

Acceptable use

You may not use the services for unlawful offerings, fraud, market manipulation, money laundering, terrorist financing or sanctions evasion; to offer instruments where this is prohibited; to claim that FLORIS³ is regulated or endorses an offering; or to attack, probe, reverse-engineer, scrape or resell the platform (other than as expressly permitted for white-label portals and intermediary tenants).

We may suspend an offering, a user or a feature where a breach, an authority’s or provider’s request, or a material security risk requires it. We limit the suspension to what is necessary, inform you without undue delay with our reasons, and lift it once the cause is removed.

• The Capital Blueprint is a fixed fee (€10,000 standard, €20,000 extended, per the scope on /pricing), agreed before we begin and invoiced when you commission it.
• The Filing Package (€15,000 per filing, included in year one for the first filing) is invoiced on the day you sign off the Blueprint.
• If your Blueprint checklist inputs arrive by the agreed dates, 50 % of the Blueprint fee is credited against the Filing Package. If they are late, the Blueprint stands at full price.
• 30-day guarantee. If the Filing Package is not submission-ready within 30 days of Blueprint sign-off, we refund the Filing Package fee — provided your inputs and approvals arrived on time. Delays caused by you, your advisers or third parties you engaged extend the period accordingly.
• “Submission-ready” means the document set agreed in the Blueprint is complete for filing. Whether and when the authority approves the filing is outside our control.

• Fees are those in the order and on /pricing. All amounts are in euro and exclusive of VAT.
• The programme is invoiced from the start of the term: in year one quarterly in advance (+5 %) or annually at once; from year two annually, quarterly (+5 %) or monthly (+8 %).
• Included units exceeded (investor subscriptions, concurrent offerings, intermediary tenants, seats) are invoiced monthly in arrears, each line with quantity and evidence in the portal.
• The Dedicated Environment setup fee is invoiced at Blueprint sign-off, before provisioning; its monthly fee from the start of the term.
• Licensed third-party services — register keeping, custody, identity verification, law-firm work, penetration tests, external audits and cloud for a Dedicated Environment — are passed through at cost plus 10 % for procurement and settlement, disclosed before you sign and itemised on the invoice. We disclose the underlying rates annually.
• On Distribution, the settlement fee is charged on commissions we settle and pay out, not on capital raised. We charge no success fee and no share of capital raised.
• Where the published risk fee applies, it is calculated and capped as set out on /pricing.
• Invoices are payable within 14 days without deduction. Objections must be raised in writing within 30 days of the invoice date.

Indexation

Recurring fees are adjusted once a year at renewal by the change in the Austrian consumer price index (VPI 2020, Statistik Austria) plus 2 percentage points, capped at 5 % per year. A fall in the index does not reduce fees.

Late payment

Late payments bear statutory default interest (§ 456 UGB) and the flat compensation under § 458 UGB. If an undisputed invoice is more than 30 days overdue, we may, after a further 14 days’ written notice, suspend new offerings and outbound communications until payment. Existing investor records remain accessible to you and your investors during a suspension.

You may set off only claims that we have acknowledged or that have been established by a court.

• The programme term begins on the day of submission to the supervisory authority, or 60 days after Blueprint sign-off at the latest, and runs for twelve months.
• If the authority’s processing delays your first offering, we extend the term by the delay, up to three months, at no charge.
• The agreement then renews for successive twelve-month periods at the renewal price unless either party gives written notice at least three months before the end of the current period.
• You may upgrade at any time, pro rata; downgrades take effect at renewal. A Dedicated Environment cannot be downgraded to the shared platform within the term.

Termination for good cause

Either party may terminate with immediate effect for good cause, in particular if the other party:

• materially breaches the agreement and does not remedy the breach within 30 days of written notice;
• becomes insolvent, or insolvency proceedings are opened or refused for lack of assets;
• is subject to sanctions, or a competent authority orders or requires the termination.

You may also terminate as set out in the SLA for chronic availability failure, and where DORA applies, on the grounds listed in the DORA addendum. We may terminate for good cause if undisputed fees remain unpaid for more than 60 days after a reminder.

After termination

Fees accrued up to termination remain payable. If we terminate without good cause being on your side, or you terminate for our good cause, we refund prepaid fees for the period after termination. Data export and exit assistance follow section 12 and the SLA.

Availability, support, backup and recovery and incident handling are governed by the Service Level Agreement. Service credits are the financial remedy for missed availability; the SLA sets out where further rights remain.

We continuously develop the platform and may change features, integrations and supported networks, provided the functions agreed in your order are not materially reduced during the term. We announce material changes at least 30 days in advance; Dedicated Environment clients control timing within their release ring.

Warranty

We perform our services with the care of a diligent professional. If a reproducible defect materially impairs an agreed function, we remedy it by repair, workaround or new version within a reasonable period in line with the SLA priorities. If the remedy fails twice for the same defect, you may request a reasonable price reduction for the affected service or, for material defects, terminate the affected service. You must report defects without undue delay; the presumption of defectiveness under § 924 ABGB does not apply. We give no warranty for defects caused by your data, configuration or integrations, by third-party services or blockchains, or by use outside the documentation.

• Public blockchains are operated by independent third parties. We do not control their availability, fees, forks, congestion or security.
• Blockchain transactions are public and irreversible. Tokens sent to a wrong address, or lost through lost or compromised keys, cannot be recovered by us.
• Private keys are generated and held by the wallet provider, the custodian or the holder — not by FLORIS³, unless a key-management arrangement is expressly agreed for a Dedicated Environment (BYOK).
• Smart contracts are deployed from audited templates. You decide on additional audits and testing before a live deployment. Where we hold administrative rights over a smart contract, we exercise them only on your instruction or where necessary for security or legal reasons, inform you without undue delay, and hand them over on exit.
• Digital assets and tokenised instruments carry legal, tax and market risks that are borne by you and your investors.

Where the platform offers AI-assisted features (for example drafting, summarising or automations), outputs may be inaccurate or incomplete and must be reviewed before use. We present these features as AI systems and mark AI-generated content in line with Article 50 of the EU AI Act. They are general productivity tools and not intended for any high-risk use under Annex III of the AI Act; you must not use them to decide on investors without human review.

Data submitted to an AI feature is processed by the provider named in the privacy policy or chosen by you. We do not use your data to train models and contractually require our providers not to.

Your data is yours. All data, documents, investor records, content and brand assets that you, your users and investors upload or generate (“Client Data”) remain your property. You grant us the non-exclusive right to process Client Data for the term and the export period, solely to provide, secure and support the services and to comply with law.

The platform, software, smart-contract and document templates, workflows, documentation and know-how remain the property of FLORIS³ and its licensors. You receive a non-exclusive, non-transferable right for the term to use the platform for your own programme and to let your investors, advisers and intermediary tenants use it as agreed. Blueprint deliverables and documents prepared for you may be used without restriction for your offerings.

We may use aggregated, anonymised usage data that identifies neither you nor any person to operate and improve the platform. We name you as a client only with your prior written consent.

If a third party claims that the platform infringes its rights, we defend you at our cost and may modify the affected part, obtain a licence or, if neither is reasonably possible, end the affected service with a pro-rata refund.

You can export Client Data at any time. At the end of the agreement we provide a complete machine-readable export within 30 days at no charge, and then delete or anonymise Client Data within 90 days unless law requires us to retain it. Data written to public blockchains cannot be deleted. Exit assistance is described in the SLA.

Both parties comply with the GDPR and the Austrian Data Protection Act. How we process personal data as controller is described in our Privacy Policy. For personal data of investors, advisers and other persons that we process on your behalf, you are the controller and we are your processor; this section is the data processing agreement under Article 28(3) GDPR:

• Subject matter and duration: provision of the services for the term and the export and deletion period.
• Data subjects and categories: investors, prospective investors, advisers, intermediaries and your users — identity and contact data, KYC and sanctions-screening results (including biometric verification results where enabled), investment, payment and wallet data, signed documents, communications and usage data.
• Instructions: we process only on your documented instructions, given through the agreement and your configuration of the platform, and tell you if an instruction appears unlawful.
• Confidentiality and security: our personnel are bound to confidentiality; we apply the technical and organisational measures in section 14 of the Privacy Policy and do not reduce their overall level during the term.
• Sub-processors: you authorise the sub-processors listed in the Privacy Policy. We inform you at least 30 days before adding or replacing one; if you object on reasonable data-protection grounds and we cannot accommodate the objection, you may terminate the affected service with a pro-rata refund.
• Assistance: we support you with data-subject requests, security, breach notification (within the deadlines in the SLA), data-protection impact assessments and prior consultations.
• Deletion: at the end of the agreement we return data through the export and delete it as set out in section 12.
• Audits: we provide the information necessary to demonstrate compliance. If that is insufficient, you or an independent auditor bound to confidentiality may audit us once a year with 30 days’ notice; audits required by an authority are always possible.
• Transfers outside the EEA take place only under the safeguards in the Privacy Policy.

If you are a financial entity under Regulation (EU) 2022/2554 (DORA) and our services support your functions, a DORA addendum forms part of the agreement. It is delivered with the setup of a Dedicated Environment and is available for the shared programmes on request. It covers in particular:

• a full description of the services, subcontracting and the locations where services are provided and data is processed;
• availability, integrity, confidentiality and security of data, and access, recovery and return of data on insolvency, resolution or termination;
• the service levels in the SLA and assistance with ICT incidents at no additional cost or at a cost set in advance;
• unrestricted access, inspection and audit rights for you, your auditors and your competent authority;
• participation in your ICT security awareness programmes and digital operational resilience testing;
• termination rights as required by Article 28(7) DORA and a mandatory transition period and exit plan.

Each party keeps the other’s non-public business, technical and financial information confidential, uses it only for the agreement and discloses it only to employees, affiliates, subcontractors, advisers and auditors who need it and are bound by equivalent obligations, or where law, a court or an authority requires it. The obligation does not apply to information that is public, already lawfully known, or independently developed, and it survives the end of the agreement for five years.

• We are liable without limitation for intent, for personal injury and wherever mandatory law excludes a limitation (for example under the Product Liability Act).
• For gross negligence, our total liability per contract year is limited to the fees paid and payable by you in the twelve months before the event giving rise to the claim.
• Liability for slight negligence is excluded.
• Except for intent, we are not liable for indirect or consequential loss, lost profit, capital not raised, failed or delayed closings, or losses caused by blockchains, wallet providers or other third-party providers that we do not control.
• Damages claims must be asserted in court within one year of the claimant becoming aware of the damage and the liable party.

You indemnify us against third-party claims, including by investors or authorities, arising from your offerings and instruments, your Client Data and content, your instructions, or your breach of the agreement or of applicable law — except to the extent caused by our breach.

We may update these Terms for new services, changes in law or supervisory practice, or changes by essential providers. We notify you at least 60 days before a change takes effect. For a running agreement, a change that is not required by law and is to your material disadvantage takes effect only with your written consent; otherwise it applies from your next renewal. Changes required by law or an authority may take effect sooner.

• Force majeure: neither party is liable for delays or failures caused by events beyond its reasonable control, including war, natural disasters, pandemics, government action, and large-scale failures of public networks or cloud providers. If force majeure lasts more than 60 days, either party may terminate the affected service.
• Subcontractors: we may use subcontractors, including FinFortus GmbH, and remain responsible for them.
• Assignment: neither party may assign the agreement without the other’s consent, except that we may assign it to an affiliate or successor that takes over the services, with notice to you.
• Non-solicitation: during the term and for twelve months after, neither party actively solicits employees of the other who were involved in the services.
• Form: changes and notices require written form; email suffices. Notices to us go to the address below.
• Severability: if a provision is invalid, the remaining provisions remain in force and the invalid one is replaced by a valid provision closest to its economic purpose.
• Language: these Terms are concluded in English; translations are for convenience.
• Governing law: Austrian law, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods.
• Jurisdiction: the competent court in Vienna, Inner City, has exclusive jurisdiction. The parties will first try to resolve disputes amicably through their named contacts.