General Terms and Conditions for xpandAI

As of: 2026-10-29  |  Version: v1.1

These General Terms and Conditions apply to the offerings xpandAI workspace and xpandAI Academy. They are divided into three parts: Part A applies to all offerings, Part B to xpandAI workspace, Part C to xpandAI Academy.

A1 Scope and Structure

For the product booked in each case, General Part A and the associated Special Part apply. For anyone who books only xpandAI workspace, Part A and Part B apply; the provisions in Part C do not apply. For anyone who books only xpandAI Academy, Part A and Part C apply; the provisions in Part B do not apply. If both offerings are used, Part A, Part B and Part C apply side by side.

The offering is aimed exclusively at businesses (Unternehmer within the meaning of Section 14 German Civil Code), legal entities under public law and persons who conclude the contract in the exercise of their commercial or independent professional activity. No contracts are concluded with consumers.

Conflicting, deviating or supplementary terms and conditions of the customer do not apply unless xpand has expressly agreed to their validity in text form (e.g. email).

A2 Provider and Contracting Party

The provider and contracting party is:

Further information can be found in the imprint of the website.

A3 Conclusion of Contract

The presentation of the services and offerings on the website does not constitute a binding offer but an invitation to place an order.

By completing the registration, ordering or booking process and clicking a button clearly labelled as entailing an obligation to pay, the customer submits a binding offer to conclude a contract. The contract is concluded as soon as xpand confirms the offer by activating access, by email or in any other suitable form.

xpand reserves the right to reject registrations or orders in individual cases, in particular if the B2B requirements are not met or if use may violate these GTC, statutory requirements or security interests.

A4 Incorporation of the GTC

During the registration, ordering or booking process, these GTC are displayed or linked to the customer. By ticking the corresponding checkbox, the customer accepts these GTC for the booked product.

The respective service, package or course description and any individual offer also form part of the contract. For xpandAI workspace, the annexes referred to in Part B additionally form part of the contract, where applicable.

The processing of personal data is described in the privacy policy. It is an information document and does not form part of the contract.

For evidentiary purposes, xpand may log the time, user account, organisation, IP address, language version, document version and accepted annexes, insofar as this is necessary for documenting the contract and for legal defence.

A5 Eligibility and Minimum Age

Use is reserved exclusively for persons with full legal capacity who are at least 18 years old and act in a professional or commercial context. In case of doubt, xpand may request proof of eligibility or of affiliation with a company.

A6 User Account and General Rules of Use

A user account is generally required for use. The customer and its users undertake to provide accurate and complete information and to update it without undue delay in the event of changes. Access data must be treated confidentially and must not be passed on to third parties.

The customer may use the offerings only within the limits permitted by law and in accordance with these GTC. The following is prohibited in particular:

• entering or processing unlawful content
• infringing the rights of third parties
• passing on access data or access to third parties
• circumventing technical protection or access measures
• attacks on systems, interfaces or security mechanisms
• any other abusive or unlawful use

A7 Prices and Payment

Prices and the scope of services are set out in the current service, package or course description, the checkout or an individual offer. All prices are net plus statutory VAT, unless expressly stated otherwise.

Payment processing may be carried out via external payment service providers, in particular Stripe. In this case, payment data is transmitted directly to the payment service provider. xpand does not store complete payment data such as card numbers; this data is processed by the payment service provider.

The product-specific terms and termination rules are set out in Part B and Part C respectively.

A8 No Consumer Right of Withdrawal

The offering is aimed exclusively at businesses and persons acting in a professional or commercial capacity. A consumer right of withdrawal therefore does not exist. Should mandatory consumer rights exceptionally apply, they remain unaffected.

A9 Availability, Support and Technical Disruptions

xpand endeavours to ensure a high level of availability of the offerings. However, uninterrupted availability is not owed unless expressly agreed otherwise. Restrictions may arise in particular from maintenance work, updates, security measures, technical disruptions, outages of or changes at third-party providers, overloads, misuse or force majeure.

Support is provided to the extent described in the respective package or offer. Reports may be sent to support-xpandai@xpand.pro.

A10 Liability

xpand is liable without limitation for intent and gross negligence, for injury to life, body or health, under the German Product Liability Act (Produkthaftungsgesetz) and in other cases of mandatory statutory liability.

In the event of a slightly negligent breach of material contractual obligations, liability is limited to the foreseeable damage typical for the contract. Material contractual obligations are obligations whose fulfilment is essential for the proper performance of the contract and on whose observance the customer may regularly rely.

Otherwise, liability is excluded to the extent permitted by law. Part B and Part C contain supplementary product-specific liability provisions.

A11 Indemnification

The customer indemnifies xpand against claims of third parties arising from the customer or its users using the offerings in breach of contract, introducing unlawful content or infringing the rights of third parties, insofar as the customer is responsible for the infringement.

A12 Amendments to the GTC

xpand may amend these GTC insofar as this is necessary due to legal, technical, operational, security-related or product-related developments and the legitimate interests of the customer are given due consideration.

The customer will be informed of material amendments at least 4 weeks before they take effect by email, in the user account or at login. If the customer does not object within the period communicated, the amendments are deemed accepted. xpand will specifically point out this consequence. In the event of a timely objection, xpand may terminate the contractual relationship with effect from the end of the current contract period or cease to provide the affected functions, insofar as continuation on the previous terms cannot reasonably be expected of xpand.

Changes to subprocessors or international model paths are governed primarily by the data protection annexes (Annexes 1 to 4, see B9). Insofar as special information or objection periods are provided for there, these take precedence for the respective data protection matter.

A13 Final Provisions

Governing law: The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

Place of jurisdiction: To the extent permitted by law, the place of jurisdiction is the registered office of xpand Deutschland GmbH.

Contract language: These GTC may be provided in several language versions. In the event of discrepancies, the German version prevails, unless mandatory statutory provisions dictate otherwise.

Order of precedence: In the event of conflicts, the following applies: (1) individual agreement or offer, (2) the relevant Special Part including incorporated annexes, (3) this General Part A. For matters of processing on behalf, the Data Processing Agreement (DPA) and the data protection annexes take precedence. Mandatory law remains unaffected.

Severability clause: Should any provision of these GTC be or become invalid in whole or in part, the validity of the remaining provisions remains unaffected. The invalid provision is deemed replaced by a valid provision that comes as close as possible to the economic purpose of the invalid provision, insofar as this is legally permissible.

This part applies only insofar as the customer uses xpandAI workspace.

B1 Platform

xpandAI workspace is a web-based platform for the professional use of AI functions. Depending on the package booked, it enables in particular access to selected language models and model paths, the creation and use of custom assistants and prompts, the use of predefined xpandAI assistants, the integration of company knowledge and knowledge stores, chat, file, search and analysis functions, as well as team, role and permission functions, insofar as included in the package.

xpand does not train its own foundation models or large language models. The platform provides access to externally developed or externally operated models and model infrastructures and combines these with its own platform, assistance, integration and support services.

B2 Packages and Model Paths

The platform is offered in different packages. The specific scope of services is set out in the service description applicable at the time the contract is concluded, the checkout, the offer or an individual agreement. According to the current product status, the following exist in particular:

• Basic: German model paths, intended in particular for data-protection-sensitive uses
• Plus: German and European model paths; according to the current configuration, Azure is used via Data Zone Standard (EUR) or an EU processing zone
• Pro: German, European and international model paths with extended model access

International model paths, in particular in the Pro package, may include processing outside Germany and outside the EU/EEA; they are described separately in the service description and/or the data protection annexes. xpand only designates model paths as German, EU, EU-only or similar if the actual technical processing corresponds to this level of protection.

B3 Changes to Models and Third-Party Services

Availability, scope of services, response quality, speed and individual functions may depend on third-party providers, their interfaces, regions and technical conditions. xpand may replace, add or remove models, providers, model paths or technical components insofar as this is necessary for technical, economic, security-related, legal or product-related reasons and the legitimate interests of the customer are given due consideration.

B4 AI-Generated Content

Content produced by integrated AI systems is generated automatically. The customer and its users are obliged to check AI outputs on their own responsibility for accuracy, completeness, suitability, lawfulness and any risks before further use. AI outputs do not replace individual legal, tax, medical, therapeutic, financial or other professional advice.

B5 Regulated Areas of Use

The platform is not primarily intended for high-risk areas of application within the meaning of the EU AI Act or for other particularly regulated areas of use, unless this has been expressly agreed. If the customer uses the platform in regulated areas, in particular in HR, health, education, credit, critical infrastructure or comparable contexts, the customer is responsible for reviewing and complying with the requirements applicable to it. This includes in particular transparency obligations, human oversight, non-discrimination, risk management, data protection impact assessment and documentation.

B6 Obligations of the Customer in the Workspace

The customer is responsible for managing its users, roles, permissions and internal approvals, insofar as these functions are available to it.

The customer is responsible for ensuring that there is a sufficient legal basis for the content, prompts, files, knowledge data and other data introduced by it and its users, as well as for selecting a suitable package and level of protection. Data requiring particular protection, in particular special categories of personal data within the meaning of Art. 9 GDPR, may only be processed in model paths suitable for this purpose and after the customer’s own review.

Problematic, inappropriate, incorrect, discriminatory or otherwise risky AI outputs can be reported to support-xpandai@xpand.pro.

B7 User Content, Rights and Access

The customer retains its rights to the content introduced by it or its users. xpand processes this content, insofar as necessary, for the provision of the contractual platform functions, for technical processing, for forwarding to models, for storage in the workspace, for error analysis, for security and for support.

xpand does not use customer data to train its own foundation models or large language models. Whether and to what extent external model providers store, log or use inputs for their own purposes depends on the respective model path, provider, contract and the data protection annexes.

Chat histories, prompts, files or other content data are only viewed insofar as this is necessary for support, error analysis, security, prevention of misuse, performance of the contract or on the basis of a documented instruction or approval by the customer. Access is restricted to persons bound to confidentiality. No general monitoring of content takes place.

B8 Term and Termination

Use is generally based on paid subscriptions. Monthly subscriptions are billed monthly and annual subscriptions for 12 months, in each case in advance. Monthly subscriptions are automatically renewed for a further month and may be terminated at any time with effect from the end of the current monthly billing period. Annual subscriptions are automatically renewed for a further year unless terminated no later than one month before the end of the term. Corporate or team offerings may provide for different terms, prices and scopes of services.

The customer may terminate via the functions provided for this purpose in the user account or in text form (e.g. email). Termination takes effect at the end of the current billing period, unless agreed otherwise. Amounts already paid are not refunded pro rata, to the extent permitted by law.

B9 Data Protection, Processing on Behalf and Model Paths

xpand processes personal data partly as a controller in its own right (e.g. registration, contract and package management, billing, security, support) and partly on behalf of the customer. Insofar as the customer or its users introduce personal data into xpandAI workspace and xpand processes this data on behalf of the customer in order to provide the platform functions, the Data Processing Agreement pursuant to Art. 28 GDPR additionally applies. The following also form part of the contract:

• Annex 1: Data Processing Agreement (in German)
• Annex 2: Technical and Organisational Measures (in German)
• Annex 3: Subprocessors and Service Providers (in German)
• Annex 4: Third-Country and Model-Path Module (in German), insofar as applicable to the booked package or the selected model path

Insofar as processing on behalf takes place, the use of a package or model path with international processing is deemed a documented instruction from the customer for the processing required for this purpose. The customer is responsible for the lawfulness of the data introduced, the fulfilment of its own information obligations, the internal approval of users, packages and model paths, the selection of a suitable level of protection and any data protection impact assessments that may be required. The processing of personal data in the Workspace is additionally described in the Workspace privacy notices (in German).

B10 Liability for AI Outputs and Data Inputs (supplementing A10)

AI outputs are automatically generated content; the customer is responsible for checking and using them. xpand is not liable for professional, legal, economic or other decisions that the customer or its users make solely on the basis of AI outputs, and gives no warranty that AI outputs are accurate, complete, up to date, free of third-party rights or suitable for a particular purpose. The customer is responsible for the data entered by it and its users, in particular for confidential information, personal data, special categories of personal data and data of third parties.

This part applies only insofar as the customer uses xpandAI Academy.

C1 Subject Matter

xpandAI Academy provides online courses, learning modules, training materials, live formats and other accompanying educational offerings, in particular on topics relating to the use of AI, data protection, organisation and productivity. The specific content, scope, form of access and duration of access are set out in the respective course, offer or service description. The Academy can be booked on its own or in addition to xpandAI workspace.

C2 Provision and Access

The content is predominantly provided as digital content for retrieval. Provision may take place via a learning management system, a protected members’ area, video platforms, download areas or via third-party providers; supplementary technical conditions or access rules of the respective provider may apply to this. The duration of access depends on the respective offer.

C3 Live Formats

Insofar as live formats are offered, dates, duration and conditions of participation are set out in the respective offer. xpand may postpone dates for organisational or technical reasons or replace them with equivalent content, insofar as this can reasonably be expected of the customer. Recordings of live formats by the customer are only permitted with the prior consent of xpand.

C4 Nature of the Content

The content of the Academy serves general information, further training and practical support. It does not replace individual legal, tax, medical, therapeutic, financial or other professional advice. xpand gives no warranty for a particular learning success, for the up-to-dateness of individual content at all times or for the suitability of the content for a particular purpose of the customer.

C5 Changes to Course Content

xpand may update, further develop, supplement or remove individual course content insofar as this is necessary for didactic, technical, legal or product-related reasons and the legitimate interests of the customer are given due consideration. The essential character of a booked course is preserved in the process.

C6 Rights of Use to Course Content

All rights to the course content, materials, videos, texts, templates and other components of the Academy remain with xpand or the respective rights holders. For the duration of the agreed access entitlement, xpand grants the customer a simple (non-exclusive), non-transferable and non-sublicensable right to use the content for its own internal professional or commercial purposes.

Any use beyond this, in particular reproduction, disclosure to third parties, public communication, recording, adaptation for distribution purposes, resale or commercial exploitation, requires the prior consent of xpand in text form (e.g. email). Insofar as access is limited to a certain number of users or seats, it is personal and non-transferable.

C7 Term and Termination

Depending on the offer, the Academy may be offered as a course booking for a one-off fee or as a subscription. For one-off bookings, the fee is billed in advance; access exists for the access period stated in the offer and ends upon its expiry without the need for termination. For subscriptions, monthly subscriptions are billed monthly and annual subscriptions for 12 months, in each case in advance. Monthly subscriptions are automatically renewed for a further month and may be terminated at any time with effect from the end of the current monthly billing period. Annual subscriptions are automatically renewed for a further year unless terminated no later than one month before the end of the term. Amounts already paid are not refunded pro rata, to the extent permitted by law.

C8 Data Protection

When providing the Academy, in particular in connection with registration, management of bookings, learning progress, completions and billing, xpand processes personal data as a controller in its own right under data protection law. Details can be found in the privacy policy. Should processing of the customer’s personal data on its behalf become necessary in an individual case, the parties will conclude a separate Data Processing Agreement.

C9 Liability for Course Content (supplementing A10)

The content serves general further training and does not replace individual professional advice. xpand is not liable for decisions or measures that the customer or its users take solely on the basis of the content conveyed.