Terms of Service

These Terms of Service (“Terms”) constitute a legally binding contract between DID Daten-Intermediär-Dienste FlexCo, FN 637970t, Treustraße 52 1200 Wien, a company duly incorporated under the laws of Austria (“DID,” “we,” “us” or “our”) and the individual or legal entity (“you” or “your”) that accesses or uses our services.

These Terms govern your access to and use of our Services. By accessing or using the Services, you agree to be bound by these Terms. These Terms do not govern the content or lawfulness of any data exchange between users. If you do not agree to these Terms, you may not access or use the Services.

The Services are provided as data intermediation services within the meaning of Article 10 (a) of Regulation (EU) 2022/868 (Data Governance Act – "DGA").

These Terms apply exclusively to entrepreneurs within the meaning of § 1 UGB. Nothing in this section shall apply to consumers within the meaning of the Austrian Consumer Protection Act (KSchG).

1. Definitions

For the purposes of these Terms

  • "Data Governance Act" or "DGA" means Regulation (EU) 2022/868.
  • "Data Intermediation Services" has the meaning set out in Article 2 (11) and Article 10 DGA.
  • "Data Subject" means an identified or identifiable natural person.
  • "Personal Data" means any information relating to an identified or identifiable natural person (e.g. name, location data, identifier)
  • “Platform” means the technical infrastructure through which the Services are provided.
  • "Data Holder" means a legal or natural person entitled to grant access to data.
  • "Data User" means a legal or natural person seeking lawful access to data.
  • “Data Sharing Agreement” means an agreement created by a Data Holder that specifies the terms under which certain data may be shared with a Data User.
  • “Data Disclosure Agreement” means an agreement created by a Data User that specifies the intended purpose, scope, and conditions under which the Data User seeks to access and process certain data through the Services. A Data Disclosure Agreement may be created independently of, and prior to, the existence or visibility of any corresponding Data Sharing Agreement and does not, by itself, grant any right to access or process data.
  • “Data Exchange Agreement” means a legally binding, purpose- and transaction-specific, electronically concluded agreement that is concluded between a Data Holder, a Data User and DID that governs the access, use, and processing of data through the Services. Where a Data Disclosure Agreement and a Data Sharing Agreement are present, the Services apply automated matching and reasoning mechanisms to assess their compatibility. Upon a successful match, the Data Disclosure Agreement and the corresponding Data Sharing Agreement together form the basis for the creation of a legally binding Data Exchange Agreement.
  • "Services" means the data intermediation services provided.

Headings are for convenience only and shall not affect interpretation of these Terms.

 

2. Compliance

We provide Services in accordance with Article 10 (a) DGA, acting as a neutral facilitator between Data Holders and Data Users. We declare that we are registered as a data intermediation service provider in accordance with Articles 11 and 12 DGA and comply with all applicable requirements of the DGA. Where personal data is processed, we comply with Regulation (EU) 2016/679 (GDPR) and applicable Austrian data protection law.

 

3. Services

Our services enable

  • the collection, recording, and management of permissions, consents, or data access requests;
  • the technical transmission of such permissions between parties;
  • the facilitation of lawful data sharing without us using the data for our own purposes.

We do not determine the purposes or means of data use by Data Users and we do not exploit data exchanged through the Services.

 

4. Registration and Self-Declaration

To use our Services, you must register via ID Austria to verify your identity and your role as Data Holder or Data User. Upon successful initial registration, your verified identity attributes may be provisioned into an EU Digital Identity Wallet, which you may subsequently use for authentication and access to the Services.

Only data necessary for authentication (e.g., unique user ID, company registry number, Wallet ID) are processed. Data is used solely to provide the Services, link to Data Sharing, Data Disclosure Agreements and Data Exchange Agreements and record Consent and Audit Logs. Authentication data will not be used for marketing, profiling, or analysis. By registering, you acknowledge and accept the processing of authentication data as necessary for the provision of the Services. All authentications and data transactions are logged for audit and compliance with relevant regulations, such as GDPR and DGA. Further information on data protection can be found in our data protection information (https://intermediary.at/privacy).

After registering to our Service, you need to complete a Self-Declaration form including information on

  • the organization on which behalf you want to share or use data (name, address, organizational type, company registry number)
  • your contact information
  • your role (Data Holder and/or Data User)
  • declarations and warranties
  • compliance with these Terms.

You are required to keep your information up to date and report any relevant changes immediately to ensure ongoing compliance with legal and organizational requirements.

 

5. User Obligations and Warranties

You warrant and agree that

  • you have the legal capacity and authority to enter into these Terms;
  • if acting on behalf of a legal entity, you are duly authorized to bind such entity;
  • all information provided during registration is accurate, complete, and up to date;
  • you have all necessary rights, permissions, consents, and legal bases required to share or access data using the Services;
  • your use of the Services complies with applicable laws and regulations;
  • you will not use the Services in a manner that infringes the rights of Data Subjects or third parties;
  • you will cooperate with us in the event of audits, supervisory authority inquiries, or regulatory investigations related to your use of the Services.

 

6. Permitted and Prohibited Use

You may use the Services solely for lawful data sharing purposes in compliance with applicable law. You shall not

  • use the Services for unlawful or deceptive purposes;
  • access or attempt to access our non-public systems, programs, data, or services;
  • reverse engineer or attempt to reverse engineer the Services, except as permitted by law;
  • attempt to re-identify anonymized data;
  • circumvent security or access controls;
  • misuse permissions or consents obtained via the Services;
  • interfere with the integrity or performance of the Services;
  • impose an unreasonable or disproportionate load on the Services.
  • copy, reproduce, distribute, or use any data, content, the Services, documentation, or our website except as permitted by law;
  • transfer any rights granted under this Agreement.

 

7. Roles and Responsibilities

7.1 Data Intermediary

We act solely as a neutral data intermediary and facilitator of data sharing and disclosure. In accordance with Article 12 DGA, we

  • do not determine the purposes or means of processing of the shared data;
  • shall not access, use, or exploit the data beyond what is technically necessary to provide the Platform services;
  • do not combine data exchanged via the Services with other data sources for its own benefit;
  • maintains structural, technical, and organizational separation between the Services and any other activities;
  • maintain secure logs of user consent, data transactions, and agreement versions for the purpose of compliance, audit, and accountability;
  • disclaim any liability arising from the content, accuracy, or lawfulness of the data shared between users to the maximum extent permitted by law without prejudice to mandatory liability under the DGA.

7.2 Data Holder

If you are acting as a Data Holder, you

  • confirm that you have control over the data you want to share and may grant access to the data;
  • shall determine the purposes and means of processing your data shared through the Platform;
  • represent and warrant that the data you provide is accurate, complete, and shared in compliance with all applicable laws;
  • may not infringe third party rights when sharing data.

7.3 Data User

If you are acting as a Data User, you

  • shall process any data received through our Services solely for the purpose specified in the applicable Data Exchange Agreement;
  • implement appropriate technical and organizational measures to protect the confidentiality, integrity, and availability of the data in accordance with applicable data protection law;
  • shall not share the data with any third party except to the extent expressly permitted under the respective Data Exchange Agreement or applicable law;
  • are solely responsible for ensuring that its processing of the data complies with all applicable legal requirements.

 

8. Data Sharing and Data Disclosure

Any access to, sharing, or disclosure of data through the Service shall occur on the basis of a Data Exchange Agreement prior to the relevant transaction, based on a corresponding Data Sharing Agreement and a Data Disclosure Agreement.

Where a Data Disclosure Agreement and a Data Sharing Agreement are present, the Services apply automated matching and reasoning mechanisms to assess their compatibility. Upon a successful match, the Data Disclosure Agreement and the corresponding Data Sharing Agreement together form the basis for the creation of a legally binding Data Exchange Agreement that must be accepted by the Data Holder and the Data User.

We act as a neutral facilitator and do not acquire any rights or obligations a Data Exchange Agreement unless expressly stated.

 

9. Data Protection and Privacy

We process personal data only to the extent necessary to provide the Services. Depending on the context, we act as a processor or independent controller under GDPR. In particular, we act as:

  • an independent controller for user authentication, audit logs, and compliance records; and
  • a processor within the meaning of Article 28 GDPR where processing is carried out solely on documented instructions of Data Holders or Data Users.

Where we act as a processor, the provision of the Services is subject to a Data Processing Agreement pursuant to Article 28 GDPR.

Data subjects may exercise their rights under GDPR, including the right to withdraw consent at any time. Further details are set out in the Privacy Policy (https://intermediary.at/privacy), which is provided for informational purposes.

 

10. Data Security and Confidentiality

We implement appropriate technical and organizational measures to ensure data security. All data accessed in the context of the Services is treated as confidential, unless lawfully disclosed. DID implements backup and recovery procedures but is not liable for downtime or data loss beyond what is reasonably preventable.

 

11. Subcontractors and Third Parties

We may engage subcontractors or technical service providers to support the provision of the Services. We ensure that all subcontractors are bound by equivalent contractual obligations and technical/organizational measures, and remains fully responsible for their compliance.

 

12. Fees

We may charge transparent, non-discriminatory fees solely for the provision, operation, and maintenance of the data intermediation services. Such fees are limited to cost-based or reasonable service charges and shall not be linked to the economic value, content, or subsequent use of the data exchanged through the service. We have the right to increase our fees annually to reflect inflation. Current fees are published on the Platform or provided prior to contract conclusion.

We reserve the right to suspend the Services in the event of non-payment.

 

13. Intellectual Property

All intellectual property rights in the Services remain with us or our licensors.

You retain ownership of all data and content you provide or make available through the Services. You grant DID a limited, non-exclusive right to process such data solely for the purpose of providing the Services. No further rights are granted except as expressly set out in these Terms.

 

14. Suspension and Termination

This Agreement is effective upon the date you first access the Services and continues until terminated by you or us. You may terminate this Agreement at any time by providing notice of termination through the Services or in writing.

We may suspend or terminate your access to the Services with immediate effect if:

  • you breach these Terms or applicable law;
  • your use of the Services creates regulatory, legal, or security risks;
  • required by law or a competent authority;
  • you fail to pay any applicable fees for the Services after reasonable notice;
  • your account or authentication credentials have been compromised, misused, or are at risk of being misused;
  • you provide false, incomplete, or misleading information during registration or in the Self-Declaration;
  • you fail to comply with lawful requests from audits, supervisory authorities, or investigations related to your use of the Services.

Upon termination, your access to the Services shall cease. Confidentiality, liability, and indemnification obligations shall survive termination, subject to statutory retention requirements.

 

15. Disclaimer of Warranties

We provide the Services and any intellectual property, content, data, documentation, or other materials provided by us “as is” and “as available”, without any express, implied, or statutory warranties of any kind, including but not limited to warranties of title, merchantability, fitness for a particular purpose, non-infringement, or any other type of warranty or guarantee. No data, documentation, or other information we provide, or that you obtain from or through the Services, creates or implies any warranty from us to you.

We expressly disclaim any knowledge of, and do not guarantee:

  • the accuracy, reliability, or correctness of any data provided through the Services;
  • that the Services will meet your specific business needs or requirements;
  • that the Services will be available at any time or location, will function uninterrupted, or will be secure. Therefore, we do not guarantee uninterrupted access. Scheduled maintenance or technical issues may result in temporary service unavailability;
  • that any defects or errors in the Services, APIs, documentation, or data will be corrected;
  • that the Services are free of viruses or other harmful code.

Your use of, access to, or download of any data or information through the Services is at your sole risk. You are solely responsible for any damage to your property, loss of data, or any other loss that may result from such access, use, or download.

Nothing in this Agreement operates to exclude, restrict, or modify the application of any implied condition, warranty, or guarantee, or the exercise of any right or remedy, or the imposition of any liability under applicable law where to do so would contravene that law or cause any term of this Agreement to be void.

 

16. Liability

The Platform is not liable for the content, accuracy, or lawfulness of the shared data. We are not liable for indirect or consequential damages except where caused by intentional or grossly negligent conduct. Liability for light negligence is limited to the fees paid in the preceding twelve months.

Nothing in these Terms limits liability where such limitation is prohibited by mandatory law.

 

17. Indemnification

You agree to indemnify and hold us harmless from and against all claims, damages, liabilities, fines, and expenses arising out of

  • your breach of these Terms;
  • unlawful data sharing or lack of a valid legal basis;
  • violations of data protection or other applicable laws by you.

 

18. Force Majeure

We shall not be liable for failure or delay in performance due to events beyond its reasonable control, including natural disasters, acts of government, network failures, or changes in law.

 

19. Amendments

We may amend these Terms where required by law, regulatory guidance, or operational necessity. Updated Terms will be made available through the Services. Continued use of the Services after the effective date constitutes acceptance of the amended Terms. Material changes will be communicated at least 30 days in advance. If you do not agree, you may terminate the Agreement without penalty before the changes take effect.

 

20. Governing Law and Jurisdiction

These Terms are governed by the laws of Austria, excluding conflict-of-law rules.

Any disputes arising out of or in connection with these Terms shall be subject to the exclusive jurisdiction of the competent courts in Vienna, Austria, unless mandatory law provides otherwise.

 

21. Miscellaneous

If any provision is held invalid, the remaining provisions remain in effect.

The use of our Services is governed by a set of contractual documents which apply in the following order of precedence (highest priority first):

  • any individually negotiated agreements concluded between the relevant parties (if any);
  • the Data Exchange Agreement concluded between the Data Holder and the Data User; incorporating the applicable Data Sharing Agreement and applicable Data Disclosure Agreement;
  • any Data Processing Agreement (DPA) concluded pursuant to Article 28 GDPR;
  • these Terms of Service.

In the event of any conflict or inconsistency between the documents listed above, the document higher in the order of precedence shall prevail.

The user's general terms and conditions shall not apply, even if their inclusion has not been expressly rejected.

You may not assign these Terms without our prior written consent. We may assign these Terms in connection with a merger, restructuring, or sale of assets.

These Terms are drafted in English and German; in case of conflict between translations, the English version prevails.

 

22. Contact Information

All legal notices and communications shall be sent via email, platform message, or registered mail to the contact details provided. Notices are effective on the date received or, if sent electronically, on the date of sending unless otherwise specified.

 

Last updated: 20 January 2026