Terms of Service

These terms apply to all contracts for the services of GuardX ("Services") between Samuel Dierich, trading as GuardX, c/o IP-Management #8262, Ludwig-Erhard-Strasse 18, 20459 Hamburg, Germany, e-mail [email protected] ("GuardX", "we", "us") and its customers ("you").

The Services are offered to businesses (§ 14 BGB) and to consumers (§ 13 BGB). Where a provision applies only to one of these groups, it says so. Deviating, conflicting or supplementary terms of the customer do not become part of the contract, even if we do not expressly object to them.

The contract for the free plan is concluded when you create an account: by submitting the sign-up form you make an offer, which we accept by activating your account. Before you submit the form, you can review and correct your entries.

Paid plans are ordered in the panel. The order process shows the plan, the price, the term and the payment methods, and lets you correct your entries before you submit a binding order. The contract is concluded when we confirm the order or provide the plan.

You must provide accurate information and keep it up to date. These terms are always available on this page; on request we send you the version that applied when your contract was concluded.

GuardX provides a reverse proxy with content delivery (CDN), a web application firewall (WAF), DDoS mitigation and DNS hosting for the domains you add. The scope of the Services follows the plan you have chosen and the product description shown at the time of the order. DDoS mitigation is included in every plan, including the free plan, and we charge no surcharge for attack traffic.

Products marked as not yet available or out of stock cannot be ordered. Once they can be ordered, these terms apply to them together with the product description shown at the time of the order.

Mitigation and filtering are automated and reduce the effect of attacks and unwanted requests. Given the nature of attacks, we do not guarantee that every attack or unwanted request is stopped, or that a legitimate request is never checked or blocked. You remain responsible for your origin servers, your content and your own backups.

We may change the Services for a valid reason, in particular to adapt them to technical developments, security requirements or changes in the law, provided that the change causes you no additional costs and is reasonable for you. We inform you in advance of changes that affect your use. The rights of consumers under § 327r BGB remain unaffected.

We operate the Services with the aim of high availability, but we do not guarantee uninterrupted availability or an availability of 100%.

We may carry out maintenance that temporarily restricts the Services. We announce planned maintenance in advance where possible and schedule it so that it affects as few customers as possible. Urgent maintenance, in particular to fix security issues, may be carried out without notice. We are not liable for damage caused by interruptions due to force majeure or other events for which we are not responsible. Your statutory warranty rights, in particular those of consumers under §§ 327 ff. BGB, remain unaffected.

The free plan is free of charge and runs for an indefinite period. You can end it at any time by deleting your domains or your account in the panel. We can end the free plan, or change its scope, with four weeks’ notice by e-mail. The right of both parties to terminate for good cause remains unaffected.

Paid plans are prepaid. The fee for each billing period is due in advance; one month means 30 days. The price, the term and the available payment methods are shown in the order process. For consumers, prices include statutory VAT.

A paid plan runs for the prepaid period and is extended only if you pay for a further period. Where a plan is offered with automatic renewal, the order process says so, and you can cancel the renewal at any time with effect from the end of the current period. If you are a consumer, a plan with a first term of more than one month is renewed after that term only for an indefinite period, and you can then terminate it at any time with a notice period of no more than one month; we refund fees already paid for any time after the termination takes effect. If a further period is not paid, the paid plan ends at the end of the current period.

We announce price changes by e-mail at least four weeks before they take effect. A period that has already been paid is not affected; a new price applies only to periods that you order or pay for after it has taken effect. If a plan renews automatically and you are a consumer, it renews at the new price only if you agree to the change, for example in the panel; if you do not agree, the plan ends at the end of the last paid period. If you are a business and do not accept a price change, you can terminate the paid plan with effect from the date the change takes effect.

Consumers have a statutory right of withdrawal for paid plans. We provide the withdrawal information and the model withdrawal form in the order process before you order a paid plan.

You must:

• use the Services only in accordance with the law and these terms;
• add only domains that you own or are authorised to control, and remove them when this authorisation ends;
• keep the DNS records and origin settings you configure accurate and up to date;
• keep your login details and API tokens secret, protect them against access by third parties and tell us without delay if you suspect misuse; we recommend enabling two-factor authentication;
• for websites you protect with GuardX, meet your own data protection obligations towards your visitors, in particular by informing them about the use of GuardX.

You are responsible for activities carried out with your account if you carried them out yourself, authorised them, or culpably made them possible, for example by breaching the obligations in this section.

You must not use the Services, or let others use them, to:

• store, transmit or make available unlawful content, including content that infringes the rights of others;
• distribute malware or operate infrastructure for botnets;
• carry out phishing or other fraud;
• send or advertise spam;
• attack third parties, including denial-of-service attacks, unauthorised scanning and attempts to break into systems;
• hide or shield origin servers that host or distribute abusive content, such as phishing pages, malware or botnet control servers, from detection, takedown or law enforcement;
• run load tests, stress tests or attack simulations against GuardX or through the GuardX network without our prior written permission (an e-mail from us is sufficient).

You can report illegal content or abuse of the Services to [email protected]. We review reports and decide on measures in accordance with section 9. We disclose data to authorities where we are legally required to do so.

We may suspend the affected Services in whole or in part, for example individual domains, if there are concrete indications that you are breaching section 8 or applicable law, if an authority or court requires it, or if this is necessary to avert a threat to the security or integrity of our network, other customers or third parties. We choose the least severe measure that is effective, take your legitimate interests into account, inform you without delay, where possible in advance, and lift the suspension as soon as the reason no longer applies.

You can end the free plan at any time (section 5); a paid plan ends at the end of its prepaid period unless it is extended (section 6). Both parties may terminate for good cause without notice (§ 314 BGB). Good cause for us exists in particular in the case of serious or repeated breaches of section 8 despite a warning, or where a warning is unnecessary because of the severity of the breach. If a paid plan ends early because of a termination for good cause, we refund the fees for the remaining prepaid period. If you are responsible for the termination, we may set off against the refund any damages that we are entitled to claim.

Notice of termination can be given in text form, for example by e-mail, or by deleting your account in the panel. After the contract ends, we delete your data as described in our Privacy Policy.

We process personal data in accordance with our Privacy Policy. Where you protect websites or APIs with GuardX or embed the GuardX captcha, we process your visitors’ data on your behalf as your processor (Art. 28 GDPR); you remain the controller and are responsible for the lawfulness of the processing.

This section is our data processing agreement under Art. 28(3) GDPR. It forms part of every contract under which we process personal data on your behalf and applies without a separate signature. The subject matter of the processing is the delivery, caching and protection of the websites, APIs, apps and DNS zones you add, for the duration of the contract. It concerns the visitors and users of these services and covers their IP addresses, connection and request metadata (for example the requested address, the method, headers including the user agent, and technical parameters of the encrypted connection), security events and content that you instruct us to cache.

As your processor, we:

• process the data only on your documented instructions, which are given by these terms and by your settings in the panel and the API, including forwarding requests to the origin servers you specify, unless EU or member state law requires otherwise; we inform you if we believe that an instruction infringes data protection law;
• ensure that everyone authorised to process the data is bound to confidentiality;
• take the technical and organisational measures required by Art. 32 GDPR;
• assist you, taking into account the nature of the processing, in responding to requests from data subjects and in meeting your obligations under Art. 32 to 36 GDPR, and notify you without undue delay after becoming aware of a personal data breach affecting your data;
• delete the data after the end of the contract or, if you ask us to before the contract ends, return it to you, unless EU or member state law requires us to store it; the central request log is deleted after 90 days in any case;
• make available the information necessary to demonstrate compliance with Art. 28 GDPR, and allow for and contribute to audits, including inspections, by you or an auditor you mandate, after reasonable notice.

You give us general authorisation to engage other processors (sub-processors), in particular providers of hosting, data-centre and network infrastructure in the EU. We bind them by contract to the same data protection obligations. A current list is available on request at [email protected]. We inform you by e-mail in advance of any intended addition or replacement, and you can object to it; if we cannot reasonably take the objection into account, you may terminate the affected Services.

We may also use connection and request data as an independent controller where this is needed to keep the GuardX network and services secure and available for all customers, as described in our Privacy Policy (section 9).

We are liable without limitation for damage caused intentionally or by gross negligence, for fraudulently concealed defects, for injury to life, body or health, under the German Product Liability Act (Produkthaftungsgesetz), to the extent that we have given a guarantee, and in all other cases of mandatory statutory liability.

In the case of slight negligence, we are liable only for the breach of an essential contractual obligation, that is, an obligation whose fulfilment makes the proper performance of the contract possible in the first place and on whose fulfilment you may regularly rely. In that case our liability is limited to the damage that is foreseeable and typical for this type of contract.

Except in the cases of the first paragraph, our liability for the loss of data is limited to the effort that would have been needed to restore the data had you made regular backups appropriate to the risk.

Otherwise our liability is excluded. These limitations also apply to the personal liability of our employees, representatives and vicarious agents.

The statutory warranty rights apply. For digital products provided to consumers, these are in particular the rights under §§ 327 ff. BGB, including the obligation to provide updates (§ 327f BGB). Claims for damages are governed by section 11.

We may update these terms for future contracts. A change applies to you only once you expressly accept it, for example when you order a new plan, order a further period yourself or confirm the change in the panel. Silence, an automatic renewal and an automatic payment do not count as acceptance. A prepaid period that is already running continues under the version that applied when it was ordered.

For the free plan, we inform you of changes by e-mail at least four weeks before we want them to apply and ask you to accept them. Until you accept, the previous version continues to apply; if you do not accept, we may end the free plan with four weeks’ notice (section 5).

We are neither willing nor obligated to participate in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG).

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). If you are a consumer, this choice of law does not deprive you of the protection of the mandatory provisions of the law of the country in which you have your habitual residence (Art. 6(2) Rome I Regulation).

If you are a merchant (Kaufmann), a legal entity under public law or a special fund under public law, or a business without a general place of jurisdiction in Germany, the courts of Germany have exclusive jurisdiction for all disputes arising from or in connection with the contract. This does not apply to consumers, and mandatory statutory places of jurisdiction remain unaffected.

Should individual provisions of these terms be or become invalid, the validity of the remaining provisions is not affected; the invalid provision is replaced by the statutory provisions (§ 306 BGB). The contract language is English.