§ 1 Provider and scope
(1) PlugTheBug is a service of Erle-IT, owner Lennart Erhard, Obere Bahnhofstraße 9, 85604 Zorneding (hereinafter “Provider”).
(2) These General Terms and Conditions (AGB) apply to all contracts for the services “Basic Check”, “Full Check” and “Consulting” (hereinafter “Services”) between the Provider and its customers.
(3) The offer is aimed exclusively at entrepreneurs (Unternehmer) within the meaning of § 14 BGB (German Civil Code), legal entities under public law and special funds under public law based in Germany. No contracts are concluded with consumers (§ 13 BGB). By submitting the request, the customer confirms that they are acting in the exercise of their commercial or independent professional activity.
(4) Deviating terms of the customer only apply if the Provider has expressly agreed to them in text form (Textform).
§ 2 Conclusion of the contract
(1) The presentation of the Services on plugthebug.de does not constitute a binding offer.
(2) By submitting the check form or any other request and confirming the email address (double opt-in), the customer makes a non-binding request. The check of the named website carried out in response to such a request has the scope of the Basic Check (§ 3(1)) and is free of charge for the customer.
(3) The Provider then sends the customer an offer by email. The contract is concluded when the customer accepts this offer in text form (e.g. by replying by email).
(4) The Provider may reject requests without giving reasons, in particular if there are doubts about the customer’s authorisation under § 5.
§ 3 Services
(1) Basic Check: regular, automated short check of the website named by the customer (one domain; additional domains for a surcharge in accordance with § 6) for significant security and legal issues. The customer only receives a notification if there is a significant finding.
(2) Full Check: regular, detailed check of the named website (one domain; additional domains for a surcharge in accordance with § 6) with a PDF report covering, among other things, security, possible deficiencies in mandatory information and legal texts, accessibility, loading time, search engine basics and email security (e.g. SPF, DKIM, DMARC).
(3) Check interval: monthly. At the customer’s request, a shorter check interval can be agreed.
(4) Consulting: advice and support with fixing findings by separate agreement.
(5) The checks are passive and non-invasive. Only publicly accessible content and configurations are checked, without logging in, without intervention in the customer’s systems and without attack or load tests. Penetration tests are not part of the Services.
(6) The reports are created with the help of AI. The reports reflect the status at the time of the check (snapshot) and do not claim to be complete. The Provider owes a careful performance of the check, but not a specific result, in particular not that the website is free of errors, secure or legally compliant. The Services are services within the meaning of §§ 611 et seq. BGB.
(7) The Provider does not make any changes to the customer’s website unless this has been expressly agreed as part of Consulting.
§ 4 No legal advice
(1) Notes on the legal notice (Impressum), privacy policy and other legal texts are general, technically supported notes on possible deficiencies. The Provider checks legal texts only formally and technically, in particular whether mandatory information is present and accessible, and does not carry out a legal assessment of the individual case. The notes do not constitute legal advice within the meaning of the Rechtsdienstleistungsgesetz (German Legal Services Act).
(2) The Provider recommends having legal questions clarified by a lawyer. Responsibility for the content and legal compliance of the website remains with the customer.
(3) The Provider does not warrant that a website will be free from warning letters (Abmahnungen), fines or security incidents after the notes have been implemented.
§ 5 Obligations of the customer
(1) The customer assures that they are authorised to have the named website checked (as the owner or on behalf of the owner). The customer indemnifies the Provider against third-party claims based on a lack of authorisation, provided the customer is responsible for this.
(2) The customer provides a current email address at which they receive reports and notifications, and notifies the Provider of any changes to the domain or contact details without undue delay.
(3) The customer ensures that the check is not prevented by technical blocks, as far as this can reasonably be expected of them. If a check fails for reasons for which the customer is responsible, the claim to remuneration remains.
(4) The implementation of notes is the responsibility of the customer.
§ 6 Prices and payment
(1) The prices stated on plugthebug.de at the time the contract is concluded apply: Basic Check 9 € per month for one domain; the monthly surcharge for each additional domain decreases evenly from 3 € for the second domain to 1,50 € for the 50th domain; Full Check 16 € per month for one domain; the monthly surcharge for each additional domain decreases evenly from 6 € for the second domain to 3 € for the 50th domain; Consulting 129 € per hour. All prices are plus statutory VAT.
(2) Basic Check and Full Check are invoiced monthly in advance. Consulting is invoiced monthly in arrears according to time spent, in 15-minute increments (per 15 minutes or part thereof).
(3) Invoices are sent by email and are payable within 14 days without deduction.
(4) In the event of late payment, the Provider may suspend the Services until payment is received, after giving prior notice in text form.
(5) The Provider may adjust the prices for subscriptions in text form with six weeks’ notice to the end of a month. In this case, the customer may terminate the contract with effect from the date on which the adjustment takes effect. The Provider points out this right in the notification.
§ 7 Term and termination
(1) Basic Check and Full Check run for an indefinite period and can be terminated by either party with 14 days’ notice to the end of a calendar month.
(2) A change between Basic and Full is possible with effect from the first day of the following month.
(3) The right to extraordinary termination for good cause remains unaffected.
(4) Notices of termination must be given in text form (e.g. email to security@plugthebug.de).
§ 8 Liability
(1) The Provider is liable without limitation for intent and gross negligence, for injury to life, body or health, under the Produkthaftungsgesetz (German Product Liability Act) and to the extent of any guarantee it has assumed.
(2) In the event of a slightly negligent breach of an essential contractual obligation, liability is limited to the damage typical for the contract and foreseeable at the time the contract was concluded. Essential contractual obligations are obligations whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the customer may regularly rely.
(3) Otherwise, liability for slight negligence is excluded.
(4) The above limitations also apply to the Provider’s vicarious agents (Erfüllungsgehilfen).
§ 9 Confidentiality
(1) The Provider treats reports and findings confidentially and only passes them on to the customer or the email address named by the customer, unless there is a legal obligation to disclose them.
(2) The Provider only sends reports to an email address on the checked domain or to the address given in the website’s legal notice or security.txt. In other cases, the Provider may request proof of authorisation before sending.
(3) The Provider may use anonymised analyses that cannot be traced back to the customer to improve its checking procedures.
§ 10 Data protection
The Provider processes personal data in accordance with the privacy policy at plugthebug.de/en/datenschutz/.
§ 11 Communication and marketing
(1) Contract-related messages such as reports, notifications of findings, invoices and notes on the performance of the contract are not advertising. The customer receives them regardless of any consent to marketing.
(2) The customer receives marketing by email
- if they have given separate, voluntary consent to this (e.g. via the checkbox in the check form, confirmed by double opt-in), or
- as an existing customer under § 7(3) UWG (German Act against Unfair Competition): if the customer has taken out a paid package, the Provider may use the email address obtained in this context for advertising its own similar services (further PlugTheBug check packages and Consulting). The customer can object to this at any time without incurring any costs other than the transmission costs at the basic rates. This right to object is pointed out when the address is collected and in every marketing email.
(3) Marketing by phone only takes place if the customer has separately and expressly consented to it.
(4) Consent to marketing is not a prerequisite for the check or for concluding the contract. It can be withdrawn at any time with effect for the future, e.g. via the unsubscribe link in every marketing email or by message to security@plugthebug.de. Withdrawal does not affect the contractual relationship.
(5) These General Terms and Conditions themselves do not contain any consent to marketing. Accepting these terms does not replace consent under para. 2(a) or para. 3.
§ 12 Changes to these General Terms and Conditions
(1) The Provider may change these General Terms and Conditions for existing subscriptions with six weeks’ notice, insofar as this is necessary for objective reasons (e.g. changes in legislation, case law, changes to the checking procedures) and the customer is not unreasonably disadvantaged as a result. The change is communicated to the customer in text form.
(2) If the customer does not object within six weeks of receipt, the changes are deemed to have been accepted. The Provider points out the deadline and the consequences of remaining silent in the notification. In the event of an objection, either party may terminate the contract with effect from the date on which the changes take effect.
(3) Changes to main performance obligations and prices are only made in accordance with § 6(5) or with the customer’s consent.
§ 13 Final provisions
(1) The law of the Federal Republic of Germany applies, to the exclusion of the UN Convention on Contracts for the International Sale of Goods (CISG).
(2) If the customer is a merchant (Kaufmann), a legal entity under public law or a special fund under public law, the place of jurisdiction for all disputes arising from this contract is the Provider’s place of business.
(3) Declarations must be made in text form unless otherwise specified.
(4) If individual provisions are invalid, the legal consequences are governed by § 306 BGB.