General Terms and Conditions (GTC)

Note: This is a convenience translation. Only the German version of these Terms is legally binding. In case of any discrepancy, the German version prevails.

PONTORA a product of Haus der Finanzen GmbH

General Terms and Conditions (GTC) of the Pontora SaaS Platform

Version 1.0 As at: 5 May 2026 Language: German (authoritative)

Provider	Haus der Finanzen GmbH — Freiburgstrasse 443, 3018 Bern — UID: CHE-462.314.248 — Authorised representative: Besar Rexhepaj, Managing Director — E-mail: info@pontora.ch
Brand / Platform	Pontora — pontora.ch
Applicable law	Swiss law (excluding conflict-of-law rules, excluding the CISG)
Place of jurisdiction	Bern, Switzerland

1. Scope

1.1 These General Terms and Conditions (hereinafter “GTC”) govern the contractual relationship between Haus der Finanzen GmbH, Freiburgstrasse 443, 3018 Bern (hereinafter “the Provider”) and its customers (hereinafter “the Customer”) with regard to the use of the Software-as-a-Service platform operated under the brand “Pontora” (hereinafter “the Pontora Platform” or “the Platform”).

1.2 The GTC apply to all products and services of the Provider in connection with the Pontora Platform, unless deviating or supplementary provisions exist for a particular service (in particular the Privacy Policy “DSE” and the Data Processing Agreement “AVV”). The GTC, the DSE and the AVV together form the contractual documentation.

1.3 By registering a Pontora account, by ordering paid modules or by actually using the Platform, the Customer unconditionally accepts these GTC as well as the DSE. Insofar as the Customer has personal data of third parties (in particular employees) processed, the AVV is additionally concluded.

1.4 The Provider reserves the right to amend or supplement these GTC at any time. Material changes will be communicated to the Customer in an appropriate manner at least 30 days before they take effect (in particular by in-app notification in the Pontora account or by e-mail). If the Customer does not object to the changes in text form within 30 days of notification, the changes are deemed to have been accepted. In the notification, the Provider will expressly inform the Customer of the possibility to object, of the deadline and of the consequences of failing to respond. In the event of a timely objection, either party is entitled to terminate the contractual relationship by ordinary notice (see section 14).

2. Subject Matter of the Contract and Service Description

2.1 Under the Pontora brand, the Provider operates a modular Software-as-a-Service platform which supports small and medium-sized enterprises (SMEs) as well as their trustees in digital business management. The Platform is available as a web application and a mobile application.

2.2 Depending on the chosen subscription and the activated modules, the range of functions includes in particular:

• Employee onboarding: recording of personnel master data and uploading of relevant documents by employees themselves;
• Task and workflow management between the trustee, the company and employees;
• Form management (e.g. accident report, sickness report) for completion by employees;
• Provision of system templates (e.g. employment contracts, letters of termination);
• Digital cash book with OCR-supported receipt and text recognition;
• Management of creditor receipts with OCR-supported receipt and text recognition;
• Uploading, filing and managing company and employee documents;
• Working time recording by employees with evaluation and full access for the company;
• Daily recording of turnover figures for gastronomy customers, broken down by type of turnover and method of payment;
• Multi-client and multi-location administration.

2.3 The OCR-supported functions (cash book, creditor receipts) and further AI-supported functions are implemented technically, among other things, via the generative AI “Claude” of Anthropic, PBC, San Francisco/USA. The Customer acknowledges that the contents of receipts are transmitted to this subcontractor for the purpose of machine recognition. Details on data flows, protective measures and the legal basis are set out in the DSE and in the AVV.

2.4 The specific scope of services and functions as well as the conditions (prices, terms, minimum order quantities) result from the chosen subscription, the Service Description as currently published on pontora.ch (hereinafter “Service Description”) and any individual order confirmations. Where special conditions exist for individual modules, these take precedence over the general provisions of these GTC in the event of a conflict.

2.5 The Provider continuously develops the Pontora Platform further and reserves the right to change, supplement or discontinue individual functions, provided this is reasonable for the Customer and the agreed core service is not materially impaired.

3. User Groups and Contractual Constellation

3.1 The Pontora Platform distinguishes the following user groups:

a) Trustees (hereinafter “Trustee Customer”): trust companies, trustees as well as accounting and personnel consulting firms. Use of the Platform by Trustee Customers is free of charge within the basic scope pursuant to the Service Description.

b) SME customers (hereinafter “SME Customer” or “client”): small and medium-sized enterprises which use the Platform to manage their operations, their personnel and their receipts. Use by SME Customers is subject to a subscription in accordance with the current price list.

c) Employees (hereinafter “employees”): employees of an SME Customer who use the Platform within the scope of their employment relationship (e.g. for time recording, onboarding, sickness or accident reporting). Employees do not become contractual partners of the Provider; their usage relationship results from the relationship with the respective SME Customer.

3.2 Trustee Customers may use the Pontora Platform for servicing their own clients. SME Customers may authorise one or more Trustee Customers to (co-)administer their data. The authorisations are mapped technically in the Platform by means of a role-based permission concept.

3.3 Contractual relationships exist in each case directly between the Provider and the Trustee Customer, or between the Provider and the SME Customer. There is no brokerage or mandate relationship between the Provider and employees.

3.4 Insofar as a Trustee Customer refers SME clients to use the Platform, the Trustee Customer acts in the name of the respective SME Customer. However, the contract is concluded exclusively between the Provider and the SME Customer directly. The Trustee Customer is neither a representative nor a broker within the meaning of brokerage law.

4. Provision of Software and Rights of Use

4.1 The Provider makes the Pontora Platform available to the Customer online in its respective current version for the duration of the contract. No local installation takes place at the Customer’s premises.

4.2 For the duration of the contract, the Provider grants the Customer a non-exclusive, non-transferable and non-sublicensable right to use the Platform to the agreed extent for its own business purposes. All copyright and intellectual property rights remain with the Provider (see section 17).

4.3 The Customer is in particular prohibited from copying, modifying, reverse engineering, decompiling the Platform in whole or in part, or using it outside the intended use. Temporary reproductions that are technically necessary for contractual use (browser cache, etc.) are permitted.

4.4 Passing the Platform on to third parties — whether for consideration or free of charge — as well as renting, leasing or redistributing it are prohibited without the express written consent of the Provider. User accounts set up by the Customer may only be used by the respectively authorised natural person; the joint use of a single user account by several persons is not permitted.

4.5 The Customer undertakes to inform its employees and other authorised users about the usage restrictions and protective rights of the Provider and to ensure compliance with them.

4.6 The Provider is entitled, upon prior announcement, to carry out reasonable audits to verify contract-compliant use. The Customer’s personality rights and business secrets are safeguarded in this process.

5. Data Hosting and Data Security

5.1 The Provider provides the storage space necessary for the contractual use of the Platform on server infrastructure in Switzerland. The Customers’ production data are stored in data centres of Amazon Web Services (AWS), region “Switzerland (Zurich)” (eu-central-2). The database layer is operated via Supabase in the same AWS region.

5.2 The Provider takes appropriate technical and organisational measures (TOM) to protect Customer data in accordance with the current state of the art. These include in particular encryption in transit (TLS) and at rest (AES-256), a role-based permission concept, two-factor authentication for administrative access, regular backups, logging as well as separation of clients (multi-tenant isolation). The TOM are described in detail in the AVV (Annex B).

5.3 Employees of the Provider have no access to production Customer data by default. Technical super-administrator access is disabled by default; temporary access is permitted only with the express consent of the Customer concerned, exclusively to remedy reported faults or to fulfil statutory obligations, and is fully logged (audit log).

5.4 The Customer is not entitled to allow third parties to use the storage space provided to it. The Customer undertakes not to store or distribute any unlawful or infringing content on the Platform and to be answerable for the lawfulness of the content it uploads.

5.5 The Customer remains the sole rights holder in respect of its data. The Provider acquires no rights to the Customer data. During the term of the contract, the Customer may request the release of individual or all data in a format customarily supported by the Provider (CSV, PDF, ZIP). There is no entitlement to release in a proprietary or specifically named format.

5.6 After termination of the contractual relationship (see section 14), the Customer is entitled to the release of all data for a period of 30 days. After expiry of this period, the Provider will irrevocably delete all Customer data — subject to statutory retention obligations. The Provider will inform the Customer of this period at the end of the contract.

5.7 The Provider is entitled to retain certain data beyond the end of the contract, insofar as this is necessary to fulfil statutory retention obligations (in particular Art. 958f OR [Swiss Code of Obligations], Art. 70 MWSTG [Swiss VAT Act]) or to safeguard its own legitimate interests (e.g. preservation of evidence in the context of pending proceedings).

6. Subcontractors and Third-Party Providers

6.1 The Provider is entitled to engage third parties as subcontractors to fulfil its contractual obligations, in particular for hosting, data storage, AI-supported functions and software development. The Provider selects these subcontractors carefully and obliges them to observe the agreed level of data protection.

6.2 A current list of the subcontractors used is published on pontora.ch as well as in Annex A of the AVV. The Customer will be informed of new subcontractors at least 30 days in advance. The Customer has the right to object to the engagement of a new subcontractor within this period for important reasons relating to data protection law. In the event of a justified objection, both parties are entitled to terminate the contractual relationship extraordinarily.

6.3 Insofar as the Provider transmits data to third-party providers within the scope of an integration chosen by the Customer (e.g. interface to Bexio, Abacus, banks or authorities), this takes place exclusively within the framework of the data flows necessary for the provision of services. The terms of use and data protection terms of the respective third-party provider apply in addition; the Provider assumes no responsibility for the content, availability or data protection practices of such third-party providers.

7. Support, Availability and Maintenance

7.1 The Provider offers standard support by e-mail and via the ticket system provided in the Pontora account during the business hours published on pontora.ch. Enquiries are processed within a reasonable period within the scope of the available personnel and technical resources. An entitlement to support outside the published hours or to a response within a specific period exists only insofar as this has been expressly agreed in a separate Service Level Agreement (SLA).

7.2 The following are excluded from standard support: problems not attributable to the Platform (in particular third-party software, internet access, the Customer’s hardware), extensive training, individual consulting or customer-specific adaptations. Such services may be provided on request against separate remuneration.

7.3 The Provider endeavours to ensure a high level of availability of the Platform. A specific minimum availability is not guaranteed unless expressly assured in the SLA. Planned maintenance work will where possible be scheduled during periods of low usage and announced in advance where a significant impact is expected.

7.4 In the event of serious disruptions, the Provider will begin remedying them within a reasonable period after becoming aware of them. The availability of third-party providers (see section 6.3) lies outside the Provider’s area of responsibility.

8. Duties and Obligations of the Customer

8.1 The Customer uses the Platform exclusively within the scope of the agreed purposes and in accordance with applicable laws. It is solely responsible for all content and data entered, uploaded or processed by it in the Platform. The Customer ensures that no rights of third parties (in particular copyright, personality or data protection rights) are infringed by the use of the Platform.

8.2 The Customer procures and maintains the IT infrastructure required for use (in particular up-to-date browsers, internet access) at its own expense.

8.3 The Customer checks all uploaded files for malware before transmission and uses up-to-date security software.

8.4 The Customer treats all access data (user names, passwords, API keys, magic links) as strictly confidential. Any suspicion of compromise must be reported to the Provider without delay. The Provider is entitled to temporarily block affected accounts or access until the matter has been clarified.

8.5 The Customer undertakes to provide truthful, up-to-date and complete information both upon registration and on an ongoing basis. In particular, authorisations of former employees or departed trustees must be revoked promptly.

8.6 The Customer — in particular SME Customers who enter personal data of their employees into the Platform — must comply with data protection requirements, in particular inform the data subjects about the data processing and, where necessary, obtain their consent. The Provider makes the necessary information available through the DSE and the AVV.

8.7 The Customer takes appropriate precautions for the event of a temporary outage of the Platform (in particular regular data export, organisational contingency plans).

8.8 If the Customer breaches its obligations, the Provider is entitled, after an unsuccessful warning, to block individual content, temporarily restrict access or terminate the contractual relationship extraordinarily (see section 14.5).

9. Fees and Payment Terms

9.1 Trustee Customers: Use of the Platform by Trustee Customers is free of charge within the basic scope pursuant to the Service Description. The Provider reserves the right to offer chargeable premium functions or extended modules for Trustee Customers; these will be clearly marked as chargeable.

9.2 SME Customers: Use of the Platform by SME Customers is subject to a subscription. The prices published at the time the contract is concluded apply (plus statutory value added tax). The Provider offers monthly and annual subscriptions. The monthly fee for monthly subscriptions is as a rule higher than the proportionate monthly price under an annual subscription.

9.3 Unless otherwise agreed, the fees are due in advance for the respective contractual period: monthly in the case of monthly subscriptions, annually in the case of annual subscriptions.

9.4 Payment is made via the payment methods supported in the Platform (e.g. credit card, direct debit, bank transfer against invoice). The Provider reserves the right to restrict individual payment methods or to support additional ones.

9.5 In the event of default in payment, the Provider is entitled to demand default interest of 5% as well as a reasonable reminder fee. In the event of prolonged default (see section 14.5), the Provider is further entitled to temporarily block the account or to terminate extraordinarily.

9.6 Price changes: The Provider is entitled to adjust the prices for SME Customers with effect from the next contractual period. Material price increases will be communicated at least 60 days in advance. If a price increase of more than 10% per year (cumulative) is implemented, the SME Customer has an extraordinary right of termination as of the effective date of the price increase.

9.7 Inflation adjustment: Irrespective of section 9.6, the Provider is entitled to adjust all fees once a year in line with inflation. The percentage change in the Swiss National Consumer Price Index (LIK) since the last adjustment is decisive.

9.8 Upgrade / downgrade: Upgrades (switching to a higher module package, adding further chargeable modules) are possible at any time; the additional costs are charged pro rata temporis. Downgrades and switches to cheaper subscriptions are only possible as of the end of the respective contractual period. Fees already paid are not refunded on a pro rata basis.

10. Contract Term, Renewal and Termination

10.1 The contractual relationship begins with the registration and activation of the Pontora account by the Provider and is concluded for an indefinite period, subject to deviating individual agreements.

10.2 The contractual relationship is automatically renewed in each case by the chosen contractual period (month or year), unless terminated in good time by one of the parties.

10.3 Both parties are entitled to terminate the contractual relationship by ordinary notice, observing a notice period of 1 month, as of the end of the current contractual period.

10.4 Termination may be given in text form, in particular via the termination function provided in the Platform, by e-mail to the Provider’s official address or by letter. For security reasons, the Provider may require a confirmation step (e.g. confirmation via an e-mail link). Receipt of the termination by the Provider is decisive for compliance with the deadline.

10.5 Extraordinary termination: Both parties may terminate the contractual relationship at any time without notice for good cause. Good cause for the Provider exists in particular in the following cases:

• insolvency or bankruptcy of the Customer;
• default in payment of at least one monthly subscription despite a written reminder with a grace period of 14 days;
• culpable breach of statutory provisions or of the rights of third parties (in particular copyright, personality or data protection rights) through use of the Platform;
• repeated or serious breach of material contractual obligations despite warning;
• use of the Platform for unlawful or criminal acts.

10.6 In the event of termination without notice by the Provider, the Provider’s claims to fees already due and to damages remain unaffected. Fees already paid in advance for periods after the termination takes effect will be refunded pro rata temporis, provided the termination is not due to conduct for which the Customer is responsible.

10.7 Death / business succession: In the event of the death of the account holder of a sole proprietorship, the Provider is entitled, after examining appropriate evidence (e.g. certificate of inheritance, power of attorney), to release the data stored in the account to legitimated persons or to transfer the account to a successor. In case of doubt or conflicting claims, the Provider may refuse release until the matter has been clearly resolved.

11. Warranty and Liability

11.1 The Provider warrants that the Platform essentially fulfils the functions provided for in the Service Description and that it is provided with due care. However, the Provider does not owe any particular economic success on the part of the Customer. The Customer acknowledges that, according to the state of the art, it is not possible to develop software in such a way that it functions faultlessly at all times.

11.2 To the extent permitted by law, any liability of the Provider for slight and moderate negligence is excluded. The exclusion of liability applies in particular to data loss, lost profit, indirect damage and consequential damage.

11.3 Insofar as liability of the Provider nevertheless exists under mandatory law despite the foregoing provisions, it is limited in amount to the fees actually paid by the Customer in the twelve (12) months preceding the event causing the damage. For Trustee Customers who use the Platform free of charge, the maximum liability amounts to CHF 1’000.– per damaging event.

11.4 The limitations of liability do not apply to damage arising from injury to life, body or health, nor to other circumstances in which a limitation of liability is not permitted by law.

11.5 For services, software and content of third-party providers (in particular integrated services pursuant to section 6.3), the Provider assumes no warranty and no liability, to the extent permitted by law.

11.6 Indemnification: The Customer indemnifies the Provider against all third-party claims resulting from an infringement of third-party rights or statutory provisions in connection with the use of the Platform for which the Customer is responsible. This includes in particular claims for infringement of copyright, personality or data protection rights. The Provider will inform the Customer of such claims without delay.

12. Data Protection

12.1 The Provider processes personal data exclusively in accordance with the Swiss Data Protection Act (DSG, in force since 1 September 2023) and — where applicable — the EU General Data Protection Regulation (DSGVO / GDPR). The details are set out in the Privacy Policy (“DSE”), which is published on pontora.ch and forms an integral part of this contract.

12.2 Insofar as the Provider processes personal data of third parties (in particular employees of the SME Customer) on behalf of the Customer, the parties additionally conclude a Data Processing Agreement (“AVV”). The AVV is made available on pontora.ch and is deemed concluded between the parties upon acceptance of the GTC, unless separate signature is expressly required.

12.3 In relation to the Provider, the SME Customer is the controller within the meaning of the DSG for the personal data of third parties entered by it into the Platform. It is in particular responsible for informing the data subjects, obtaining any consents and safeguarding the rights of data subjects.

13. Intellectual Property Rights

13.1 All intellectual property rights (in particular copyrights, patent, trademark, design and database rights as well as know-how) in the Pontora Platform, the “Pontora” brand, the logo, the website and the content created by the Provider remain exclusively with the Provider or its licensors.

13.2 The Customer receives only the rights of use expressly granted in these GTC (see section 4). In particular, the Customer acquires no rights to the source code, to the “Pontora” brand or to logos, images, texts or other content of the Provider.

13.3 Feedback: If the Customer submits feedback, suggestions for improvement or error reports, the Provider is entitled to use these free of charge for the further development of the Platform. Any rights resulting therefrom belong exclusively to the Provider.

13.4 If the Customer infringes the Provider’s intellectual property rights, the Provider is entitled to block access to the Platform immediately and to terminate the contractual relationship extraordinarily (section 10.5).

14. Confidentiality

14.1 The parties treat all confidential information of the other party (in particular business secrets, customer data, technical and financial information) as strictly confidential during and after termination of the contractual relationship.

14.2 Excluded from the confidentiality obligation is information which (a) is publicly known, (b) was already lawfully known to the recipient prior to disclosure, (c) was developed independently of the contractual relationship or (d) must be disclosed on the basis of statutory obligations.

14.3 Reference naming: The Provider is entitled to use the Customer’s name and company logo for reference purposes (in particular on the website, in presentations and marketing materials). The Customer may object to being named as a reference at any time for valid reasons; in such a case, the Provider will refrain from such naming in future.

15. Notices

15.1 Unless a stricter form is prescribed by law or by contract, legally relevant notices may be given in text form (e-mail, in-app notification in the Pontora account, letter). Notices from the Provider are deemed to have been received when they have been sent to the address last provided by the Customer.

15.2 The Customer keeps its contact details (in particular e-mail address, postal address) in the Pontora account up to date at all times. As long as the Customer fails to comply with this obligation, notices to the address last provided are deemed to have been validly delivered.

16. Final Provisions

16.1 Applicable law: This contract is subject exclusively to Swiss law, excluding the conflict-of-law rules of private international law and the Vienna Sales Convention (CISG).

16.2 Place of jurisdiction: The exclusive place of jurisdiction for all disputes arising out of or in connection with this contract is Bern, Switzerland. The Provider is also entitled to bring proceedings against the Customer at its registered office or domicile. Mandatory statutory places of jurisdiction remain reserved.

16.3 Severability clause: Should individual provisions of this contract be or become invalid, void or unenforceable, the validity of the remaining provisions shall not be affected thereby. The parties will replace the invalid provision with a valid one that comes closest to its economic purpose. The same applies to any gaps in the contract.

16.4 Language and precedence: These GTC exist in the German language. Translations serve information purposes only; in the event of a conflict, the German version prevails.

16.5 Precedence of individual agreements: In the event of a conflict, individually agreed provisions in writing take precedence over these GTC. General terms and conditions of the Customer do not apply unless their validity has been expressly acknowledged in writing by the Provider.

16.6 Contractual documents: In the event of contradictions between the contractual documents, the following order of precedence applies: (1) individual written agreement, (2) order confirmation / acceptance of order, (3) Data Processing Agreement (AVV), (4) these GTC, (5) Privacy Policy (DSE), (6) Service Description.

---

Pontora · a product of Haus der Finanzen GmbH · Bern · Version 1.0 · 5 May 2026