General Terms and Conditions

These legal texts are binding in German only (registered office: Nuremberg, Germany).

Version: 10 October 2026 (edition 3.0; supplements edition 2.0 of 15 July 2026 with Part D for orders placed via the REGULARUS platform) · Convenience translation - only the German version is binding.

Part A - General Part

§ 1 Scope, Contracting Parties, Definitions and Form

(1) These GTC apply to all services of the brand "REGULARUS" ("Provider"), operated by CONIUNCTA GmbH, Breslauer Strasse 350, 90471 Nuremberg. They concern Regulation (EC) No 1223/2009 ("Cosmetics Regulation") and the cosmetics law applicable to Great Britain. References to articles without further specification relate to the Cosmetics Regulation.

(2) The offer is directed exclusively at entrepreneurs (Section 14 of the German Civil Code (BGB)). This includes persons concluding the contract in order to take up a commercial or independent professional activity (business founders). The Customer warrants that it is acting in the exercise of, or in order to take up, its commercial or independent professional activity.

(3) The Customer's terms and conditions shall not become part of the contract unless the Provider agrees in text form. This also applies where performance is rendered without reservation in the knowledge of such terms and conditions.

(4) Definitions: "PID" is the Product Information File pursuant to Art. 11 (in English PIF; the service "PIF maintenance" concerns the same subject matter), "CPSR" the Cosmetic Product Safety Report pursuant to Annex I, "SBA" the safety assessor pursuant to Art. 10(2), "RP" the Responsible Person pursuant to Art. 4, "RP mandate" the assumption of the RP function by the Provider validly conferred pursuant to Art. 4, "CPNP" the notification portal of the European Commission, "SCPN" the British notification service for England, Wales and Scotland (Northern Ireland is notified in the CPNP), "SUE" a serious undesirable effect pursuant to Art. 2(1)(p), "Trader" the distributor, "Continuing services" the RP mandate (EU and UK), PID maintenance and retainer, "text form" the text form pursuant to Section 126b of the German Civil Code (BGB) (email is sufficient).

(5) Text form is sufficient for the Customer's declarations, notifications, evidence, complaints, approvals, terminations and objections. Excepted is solely the mandate letter pursuant to § 16 and its acceptance. The form required therein follows from Art. 4(3) to (5).

(6) Individual contractual agreements take precedence (Section 305b of the German Civil Code (BGB)) and require no particular form.

(7) Part A (§§ 1 to 13) applies to all contracts. Part B (§§ 14 to 19) applies only where an additional service has been booked. Part C (§ 20) contains the final provisions. Part D (§§ 21 to 27) additionally applies to orders placed via the REGULARUS platform and takes precedence over Parts A and B in that respect.

§ 2 Services, Order of Precedence, Contract Types and Services Not Owed

(1) The services are modular. The core service (§ 4) is always part of the contract unless the offer provides otherwise. The following can be booked individually or as a package: label and artwork review (§ 14), CPNP and UK SCPN notification (§ 15), EU RP and UK RP as a service (§§ 16 to 18) as well as PIF maintenance, amendment service and retainer for authority enquiries and cosmetovigilance (§ 19). The UK services can also be booked individually. § 15 remains unaffected.

(2) What is owed is exhaustively set out in the offer and the order confirmation. The selection in the enquiry form is not a booking. It does not establish any claim.

(3) In the event of contradictions, the following order of precedence applies: individual agreements, offer and order confirmation including the specification sheet, Part B, Part A, Part C. For the designation, scope and acceptance of the RP mandate, the mandate letter (§ 16) takes precedence. For platform orders, the order summary and the declaration of acceptance take the place of the offer and the order confirmation; Part D takes precedence over Parts B and A.

(4) Without a separate order, the following in particular are not owed: laboratory analyses and tests of any kind; efficacy and claim substantiation studies (Art. 20, Regulation (EU) No 655/2013) and the review of advertising claims; the procurement of raw material specifications, safety data sheets and allergen declarations from the Customer's suppliers; formulation development, reformulation and the search for substitute substances; the establishment, audit and certification of a quality management system (Art. 8, EN ISO 22716); obligations under REACH, CLP and packaging, waste, customs and import law; assessments under trademark, design, competition, fair-trading and medicinal advertising law and the delimitation from medicinal products, medical devices, biocides and foodstuffs; registrations outside the EU and the United Kingdom; translations. § 20 remains unaffected.

(5) The Provider renders regulatory expert advice, not legal advice. Legal opinions and the representation of the Customer in fine, administrative or court proceedings are not owed; in this respect the Provider recommends a lawyer. Insofar as the Provider acts as RP, it acts in its own name and in fulfilment of its own statutory obligations; to that extent there is no legal service in another party's affairs.

(6) The Provider supplements missing information at its dutiful discretion from public sources and documents it. It does not procure documents from the Customer's suppliers. The Customer remains responsible for the completeness of the raw material documentation.

(7) With the RP mandate, the Provider assumes solely the function of the RP. It does not assume any further position as manufacturer, quasi-manufacturer, importer, authorised representative or other economic operator; such a position requires a separate agreement. Without this, the Customer may not designate or present the Provider in another capacity, whether in marketplace listings, shops or advertising material or vis-a-vis authorities. § 11 remains unaffected.

(8) Contracts for work (§ 631 BGB) are the core service (§ 4), label and artwork review (§ 14), notification (§ 15) and amendment service (§ 19); § 8 applies to them. Services (§ 611 BGB) are the RP mandate, PIF maintenance and retainer; no result is owed, no acceptance takes place, and § 8 does not apply. § 19 applies to documents arising from PIF maintenance.

§ 3 Offer, Conclusion of Contract and Duties to Inform

(1) The inquiry is free of charge and non-binding. The confidentiality under § 9 applies from receipt of the inquiry, irrespective of the conclusion of the contract.

(2) The Provider makes offers in text form. One-off services are provided at a fixed price, continuing services at a fixed recurring remuneration. Prices are net plus value added tax. The offer is valid for 30 days unless stated otherwise.

(3) The contract is concluded upon acceptance in text form. These GTC in the version applicable at the time the offer was made thereby become part of the contract. The offer refers to them and makes them available for retrieval. The RP mandate additionally requires the mandate letter (§ 16).

(4) For continuing services, the Provider indicates in the offer and in the order confirmation, in a typographically highlighted manner and citing the sections, the following: minimum term, tacit renewal, notice period and notice address (§ 13), approval reservation (§ 17), indemnification obligation (§ 11), insurance obligation including run-off liability (§ 17), contractual penalty (§ 18) and post-contractual archiving and availability flat fee (§ 18). If an indication is omitted, the relevant provision does not become part of the contract.

(5) Time specifications are non-binding guide values from the point at which the documents are complete pursuant to § 5. They do not constitute a fixed-date transaction. Binding deadlines require an express agreement in text form.

(6) The fixed price is based on the legal situation at the time the offer was made. If subsequent legal changes, SCCS opinions or official requirements lead to significant additional work, the Provider submits a supplementary offer. Without agreement within 14 days, either party may terminate the affected order in text form. The Provider retains the remuneration for services rendered. There is no unilateral right to determine the price.

§ 4 Core Service: PIF, CPSR and INCI Label Proposal

(1) From the Customer's formulation and product information, the Provider prepares the PIF and CPSR (Part A and B) pursuant to Annex I. The safety assessment is carried out by a qualified SBA. The SBA provides the CPSR with name, proof of qualification and signature.

(2) The core service includes a proposal for the list of ingredients pursuant to Art. 19(1)(g) and Art. 33 in conjunction with the glossary (Commission Implementing Decision (EU) 2019/701). It comprises: resolution of blends, consolidation of identical INCI names, descending order, special rule below 1 percent, ordering of colorants, addition of "[nano]" and fragrance allergens pursuant to Annex III and Regulation (EU) 2023/1545. The proposal is a technical recommendation. Responsibility for the final labelling pursuant to Art. 19 lies with the Customer or the RP. Where there is an RP mandate, § 17 and § 18 additionally apply.

(3) If the notification is not commissioned under § 15, the core service includes the CPNP notification assistance, a structured data package with the information pursuant to Art. 13. It is included in the fixed price. Submission is then the responsibility of the Customer or its RP.

(4) The signing of the CPSR is a technical safety assessment based on the Customer's data, not a release for marketing. Placing on the market additionally requires, in particular, notification (Art. 13), a compliant label (Art. 19), good manufacturing practice (Art. 8), where applicable the nanomaterial notification (Art. 16(3)) and an effectively designated RP.

(5) SBA and RP are different roles. Commissioning the CPSR does not establish an RP mandate.

(6) Cosmetic products do not undergo any authorisation procedure. The notification is not an approval and is not examined as to its content. The Provider owes proper performance according to the state of science and technology, in particular in accordance with the SCCS Notes of Guidance in the version applicable at the time of performance. It owes no success vis-à-vis authorities. It does not warrant that authorities will not object, will not take a sample or will not take any measure.

§ 5 Cooperation and Responsibility of the Customer

(1) The Customer transmits the complete quantitative formulation (all raw materials with use concentrations, and, in the case of blends and fragrance oils, their composition), the available supplier data sheets and specifications, as well as information on product type, application, target group, packaging and target markets.

(2) For a complete PIF (Art. 11(2)) the Customer additionally provides: a) a description of the method of manufacturing and a statement on compliance with good manufacturing practice together with proof thereof (EN ISO 22716 or equivalent); b) the minimum durability, the period of use after opening and stability data; c) evidence to substantiate the claimed effect (Art. 20, Regulation (EU) No 655/2013); d) data on animal testing (Art. 18); e) information on packaging material and material compatibility; f) the final label or artwork.

(3) The Customer fully discloses nanomaterials (Art. 2(1)(k)) and, insofar as Art. 16 applies, provides the information required under Art. 16(3). The product must then be separately notified to the Commission six months prior to being placed on the market; the Provider is not responsible for the resulting postponement of market entry. Art. 16 does not apply to nanomaterials used as colorants, UV filters or preservatives regulated under Art. 14 or complying with Annex III. Labelling ("[nano]") and the indication in the notification remain unaffected in all cases.

(4) The Customer warrants the accuracy and completeness of its information. The Provider does not verify it as to content, but checks its plausibility within the customary professional scope.

(5) The Provider does not procure or produce missing documents. Where mandatory components are missing, the PIF remains incomplete; the Provider may refuse release of the CPSR, notification and, under an RP mandate, consent to placing on the market.

(6) In the event of a failure to cooperate, deadlines are extended appropriately. The Provider specifies the missing documents in concrete terms. Further rights remain unaffected.

(7) The Customer designates a technically responsible contact person with a deputising arrangement and keeps that person's contact details up to date.

(8) Supplementary continuing obligations under an RP mandate are governed by § 17, and the requirements for PIF maintenance by § 19.

(9) Without an RP mandate, the obligations of the Responsible Person (Art. 4 and 5) remain with the Customer or its Responsible Person. These include in particular keeping the PIF available for ten years after the last batch was placed on the market (Art. 11(1) second sentence, "ten-year period"), making it accessible to the authority (Art. 11(3)), notification (Art. 13), communication with authorities, and updating the safety assessment (Art. 10) and the PIF. Without booked PIF maintenance, the Provider does not monitor the legal situation and owes no update of the work results. In that case it merely retains the documents in a supporting capacity; the Customer's retention obligation remains in force (§ 20).

(10) The Customer ensures that its distributors fulfil the obligations under Art. 6 and report any non-conformities and undesirable effects to it without undue delay.

§ 6 Remuneration, Payment and Default

(1) For one-off services, the fixed price of the offer applies. The remuneration falls due upon acceptance (§ 8). Invoices are payable within 14 days of receipt without deduction.

(2) The fixed price includes queries and correction loops up to release by the SBA, insofar as they relate to the formulation transmitted at the time of the order and the information supplied in respect thereof, as well as minor changes before release without a renewed safety assessment. Any other change to the formulation, packaging, use or target market initiated by the Customer during processing is a new subject of assessment and is remunerated separately. The Provider shall point this out in text form before the additional work begins. § 19 applies to reassessments after release.

(3) Continuing services are remunerated, at the Customer's choice, as a fixed annual or quarterly flat fee. The Customer makes this choice upon conclusion of the contract in text form and may change it at the end of each term. The flat fee falls due in advance at the beginning of the billing period, payment term 14 days net. In the event of a start or end during the year, billing is on a pro rata temporis basis.

(4) Services outside the agreed scope are remunerated at the hourly rate stated in the offer, for example the handling of serious undesirable effects, proceedings before authorities, withdrawal, recall and unscheduled change assessments. From an expected more than five hours per matter, the Provider shall obtain the Customer's release in text form. This does not apply in the case of imminent danger or in the fulfilment of a statutory obligation incumbent on the Provider as RP.

(5) In the event of default in payment, the Customer owes interest of 9 percentage points above the base interest rate and a flat fee of 40 euros (Section 288(2) and (5) of the German Civil Code (BGB)). The right to claim further damage remains reserved.

(6) In the event of default in payment of more than 30 days after reminder, the Provider may, after announcement in text form, suspend all services that are not statutorily mandatory, in particular PIF maintenance, the amendment service, retainer processing, new assessments, label, artwork and product releases and new notifications. Its statutory obligations as RP (in particular Art. 5, 11, 21, 23 and 25) are not suspended; § 20 applies. It may extraordinarily terminate the RP mandate (§ 13) with the consequences of § 18.

(7) If the Provider extraordinarily terminates a continuing service for a reason for which the Customer is responsible, it retains the remuneration for services rendered and may demand compensation for the termination damage; saved expenses and alternative earnings are to be credited. Instead of itemized proof, it may demand 30 percent of the remuneration attributable to the remaining term of the current billing period. The Customer reserves the right to prove lower, and the Provider the right to prove higher, damage. If the Customer extraordinarily terminates for a reason for which the Provider is responsible, the latter refunds prepaid remuneration for services not rendered on a pro rata temporis basis.

(8) The Customer may set off only with undisputed counterclaims that have been established by final and binding judgment or are ready for decision, as well as with such claims arising from the same reciprocal relationship, for example on account of defects in the same service. It has a right of retention insofar as its counterclaim is based on the same contractual relationship, otherwise only if that counterclaim is undisputed, established by final and binding judgment or ready for decision. Section 320 of the German Civil Code (BGB) remains unaffected.

§ 7 Price Adjustment for Continuing Services

(1) The Provider may adjust the remuneration for continuing services at most once every twelve months, at the earliest upon expiry of the minimum term.

(2) The benchmark is the change in the following cost factors since the last price setting: a) staff costs, measured against the index of gross monthly earnings of the Federal Statistical Office in the economic sector "provision of professional, scientific and technical services", 70 percent; b) professional and financial loss liability insurance, 10 percent; c) costs of the subcontractors (Section 9), 20 percent. The adjustment may not exceed the actual change. It is additionally limited to the change in the consumer price index for Germany plus 3 percentage points.

(3) In the event of falling cost factors, the Provider is obliged to reduce the price. It shall announce every adjustment at least six weeks in advance in text form. In doing so, it shall disclose the cost factors, weighting and calculation.

(4) If an increase exceeds 5 percent of the remuneration owed for the affected service in the same period of the previous year, the Customer may extraordinarily terminate that service in text form as of the time the increase takes effect. The Provider shall point this out in the announcement. In the case of an RP mandate, Section 18 and its fallback rule apply.

§ 8 Acceptance, Rights in Respect of Defects, Limitation and Termination for Work Performances

(1) This section applies to work performances under § 2. § 19 applies to PIF maintenance.

(2) The Customer shall inspect the work results within 14 days of handover and shall accept them or specifically give notice of defects, in each case in text form. Obvious defects must be notified within the deadline, otherwise the statutory provisions apply. An obligation to give notice of defects under Section 377 of the German Commercial Code (HGB) is not agreed.

(3) Acceptance shall be deemed granted if the Customer, within the deadline, neither accepts nor specifically gives notice of defects, or if the Customer uses the work results beforehand, in particular by notification or placing the product on the market. This deemed acceptance only takes effect if the Provider, upon handover and setting of the deadline, drew attention to the commencement of the deadline and the consequences of silence. Rights in respect of defects are lost only pursuant to this paragraph.

(4) In the event of a defect, the Provider shall first have the right to subsequent performance within a reasonable period. As a rule, it shall be deemed to have failed after the second unsuccessful attempt. If it fails, if the Provider seriously and definitively refuses it, if it is unreasonable, or if the setting of a deadline is legally dispensable, the Customer may reduce the remuneration or withdraw from the contract. Damages are governed by § 11.

(5) A differing legal opinion or assessment by an authority does not in itself constitute a defect if the performance corresponded to the state of science and technology and to the SCCS Notes of Guidance in the version in force at the time the performance was rendered. A technical error by the Provider nevertheless remains a defect.

(6) No defect exists insofar as the work results are incorrect due to inaccurate or incomplete information provided by the Customer, unless the Provider should have recognized this during the plausibility check (§ 5). § 11 remains unaffected.

(7) Claims in respect of defects become time-barred within two years from the end of the year in which the claim arose and the Customer obtained knowledge of the circumstances giving rise to the claim or would have obtained such knowledge but for gross negligence, at the latest five years after acceptance. The shortening does not apply in the cases of § 11 and not in the case of fraudulently concealed defects. Other claims of the Customer become time-barred in accordance with the statutory provisions.

(8) If the Customer terminates a contract for work before completion without a reason attributable to the Provider (Section 648 of the German Civil Code (BGB)), the Provider shall retain the agreed remuneration less saved expenses and less any earnings acquired elsewhere. Instead of an itemized statement, the Provider may demand: a) 15 percent before commencement of processing; b) 40 percent after commencement, before submission of the CPSR to the safety assessor; c) the full remuneration after release by the safety assessor. The Customer reserves the right to prove a lower claim, and the Provider the right to prove a higher claim.

§ 9 Confidentiality, Involvement of Third Parties and Data Protection

(1) The Provider treats the Customer's formulations, specifications and other non-public information as strictly confidential. It uses them only to perform the contract and to fulfil legal obligations. It passes them on only insofar as this is necessary to perform the contract or required by law, in particular to the SBA and to third parties pursuant to paragraph 5, and, for UK services, to the UK partner.

(2) Confidentiality applies from receipt of the enquiry, irrespective of the conclusion of a contract, and continues beyond the end of the contract. In the absence of an engagement, the Provider deletes the transmitted documents no later than six months after the last contact, unless a retention obligation precludes this. Confidentiality does not preclude retention pursuant to § 20; retention of the PIF during the ten-year period remains permissible and required.

(3) Disclosures required or permitted by law are admissible, in particular: making information available to the public (Art. 21); notification of the frame formulation (Art. 13(1)(h)) and its provision to poison centres (Art. 13(6)); reporting of serious undesirable effects (Art. 23), including against the Customer's will; information provided to authorities (Art. 5(3), Art. 22, 24, 25); immediate information of the authorities in the event of a risk to human health (Art. 5(2)).

(4) Access to Customer data is restricted at system level to the persons involved in the engagement. Access and processing are logged in an audit log.

(5) The Provider may engage third parties (subcontractors, partners, vicarious agents) without the Customer's consent, in particular the SBA and the UK partner, through whom UK SCPN notification and the UK RP mandate are provided. It contractually obliges them to confidentiality to at least the extent to which it is itself bound. Upon request, it provides a list of the subcontractors in text form. It is liable for their acts and omissions as for its own (Section 278 of the German Civil Code (BGB)); no exclusion of liability for vicarious agents applies.

(6) Where the Provider acts as UK RP through a partner, it discloses that partner's name and address. It announces a change of partner at least three months in advance in text form. It bears the costs of the resulting relabelling, including artwork and reprinting, unless the change is based on a circumstance for which the Customer is responsible.

(7) The UK services require the transmission of the formulation, CPSR and PIF to the UK partner and thus to a third country. Exclusive data storage within the European Union is not guaranteed in this respect.

(8) Details on data protection are set out in the privacy policy. Where the Provider processes personal data on the Customer's behalf and subject to its instructions, the parties conclude a data processing agreement pursuant to Art. 28 GDPR before the start of performance. Its conclusion is a prerequisite for the RP mandate (§ 16(9)), PIF maintenance and the retainer. Insofar as the Provider fulfils its own legal obligations as RP, for instance when receiving, assessing and reporting undesirable effects (Art. 21, 23), it is a controller within the meaning of Art. 4(7) GDPR. The roles are determined for each service in the data processing agreement.

(9) The Customer grants general authorisation for the engagement of further processors (Art. 28(2) GDPR), in particular the UK partner. The Provider informs the Customer of intended changes in text form. The Customer may object within 14 days for good cause. In the event of a justified objection, either party may terminate the affected service; § 18 applies.

(10) The transmission to the UK partner takes place on the basis of the applicable adequacy decision. If this ceases to apply, the Provider concludes standard contractual clauses (Art. 46(2)(c) GDPR) without undue delay or bases the transmission on another permissible mechanism. Until then, it suspends the transmission and informs the Customer.

(11) Reports of undesirable effects may contain health data (Art. 9 GDPR). The Customer warrants that it has a legal basis and has informed the data subjects. It transmits only the data necessary for assessment and reporting.

(12) Statutory retention obligations, in particular the ten-year period as well as obligations under commercial and tax law, take precedence over claims for erasure and restriction. The processing of the data concerned is restricted, and the data is used only to fulfil these obligations and for legal defence.

§ 10 Rights in the Work Results

(1) Upon full payment, the Customer receives the exclusive right, unlimited in time and territory, to use the work results prepared for it for regulatory purposes. Work results are the services designated in the offer, in particular the PIF, CPSR, INCI label proposal, label and artwork review report, notification assistance, CPNP and SCPN notification data including reference numbers, change assessments, maintenance reports and vigilance documentation.

(2) The rights apply only to the formulation, packaging and label version designated in the report as well as the conditions of use and target markets stated therein. Use for differing formulations, packaging, applications or markets is not permitted. It renders the assessment meaningless. The Provider is not liable for the consequences thereof.

(3) The name, qualification and signature of the safety assessor may only be used in connection with the released report and the assessed version. Reports may not be modified in terms of content or used in excerpts in a misleading manner.

(4) The Customer indemnifies the Provider and the safety assessor against all claims based on a use contrary to paragraph 2 or paragraph 3. Section 11 applies accordingly.

(5) The Provider retains a non-exclusive right of use and retention, unlimited in time, to the extent necessary for the fulfilment of its legal obligations, in particular as Responsible Person and for retention during the ten-year period, as well as for legal defence. The Provider's calculation models, databases, templates and software components remain with it.

(6) The Customer may demand the release of the complete PIF as well as the CPNP and SCPN reference data in a common, reusable electronic format, in particular upon termination of a Responsible Person mandate (Section 18, Section 20).

§ 11 Liability and Indemnification

(1) The Provider performs with the care of a proper specialist undertaking in accordance with the state of science and technology, in particular in accordance with the SCCS Notes of Guidance in their respective applicable version. It adjusts services already rendered to subsequent legal changes only where PIF maintenance has been booked or an RP mandate exists (§ 5). It does not owe any specific result vis-a-vis the authorities (§ 4).

(2) All exclusions and limitations of liability in these GTC are subject to the proviso of this § 11. They do not apply in cases of intent, gross negligence, injury to life, body or health, and in all cases of mandatory statutory liability.

(3) The Provider is liable without limitation: a) in cases of intent and gross negligence; b) for injury to life, body or health; c) under the Product Liability Act (Produkthaftungsgesetz) and the mandatory provisions replacing it; d) upon the assumption of a guarantee or a procurement risk; e) in the event of fraudulent concealment of a defect; f) otherwise in cases of mandatory statutory liability. In such cases, neither the maximum amounts under paragraph 5, nor the series loss under paragraph 7, nor the shortening of the limitation period under § 8 apply.

(4) In cases of simple negligence, the Provider is liable only for the breach of essential contractual obligations (cardinal obligations), the fulfilment of which makes the proper performance of the contract possible in the first place and on which the contractual partner may rely, limited to the foreseeable damage typical of the contract. These include in particular the proper safety assessment pursuant to Annex I, the release by a qualified SBA, confidentiality, as well as, in the RP mandate, availability to the authorities and keeping the PIF available.

(5) In the case of paragraph 4, liability is limited to the order value of the affected service, in the case of continuing services to the remuneration paid for that service in the last twelve months before the loss-triggering event, but at least to EUR 250,000 per loss event and EUR 500,000 per contract year; the higher amount shall prevail. The maximum amounts also apply to indirect damage, consequential damage, lost profit, as well as recall, relabelling and destruction costs. No exclusion of these damage items is agreed.

(6) The maximum amounts under paragraph 5 do not apply insofar as the Customer proves that the foreseeable damage typical of the contract is higher in the individual case; in that case, the Provider is liable in the amount of the foreseeable damage typical of the contract.

(7) Several losses arising from the same cause or from several similar, internally connected causes shall be deemed a single loss event; the first breach of duty shall be decisive. Notwithstanding this, the limitation period shall be governed by § 8 and the statutory provisions.

(8) During the term of the contract, the Provider maintains professional indemnity or financial loss liability insurance of at least EUR 250,000 per loss event and EUR 500,000 per insurance year and proves it upon request by confirmation from the insurer. It does not limit liability; this § 11 applies regardless of whether and in what amount the insurer pays.

(9) If a loss is based on incorrect, incomplete or delayed information from the Customer, on the breach of its notification, reporting, cooperation or release obligations, or on a manufacture, labelling or placing on the market of the product deviating from the assessed formulation, packaging or use, then liability lapses or is reduced according to the shares of causation and fault (Section 254 of the German Civil Code (BGB)).

(10) The Customer shall notify imminent and occurred losses without undue delay and keep them to a minimum within what is reasonable.

(11) The Provider is not liable for missed deadlines due to disruptions, changes or unavailability of the CPNP and SCPN portals, changed official format or content requirements, or delayed or incomplete supply by the Customer, insofar as it is not responsible for them; the deadlines shall be extended reasonably.

(12) This does not entail any change in the burden of proof to the detriment of the Customer.

(13) These liability provisions also apply for the benefit of the legal representatives, employees and vicarious agents of the Provider, of the SBA and of the third parties under § 9, including for their personal liability. § 9 remains unaffected.

(14) The Customer indemnifies the Provider, its legal representatives, its employees, the SBA and the third parties under § 9 against all third-party claims, official measures, fines and consequential costs, including reasonable legal defence costs, which are based on the fact that: a) the product does not comply with EU or UK cosmetics law; b) information from the Customer was incorrect or incomplete; c) the Customer breached cooperation, notification, reporting, release or insurance obligations; d) the product was manufactured, labelled, advertised or placed on the market deviating from the assessed formulation, packaging or label version; e) the Customer used the name or address of the Provider contrary to § 18; f) the Customer, after termination of an RP mandate, placed goods bearing the Provider's address on the market or did not designate a new RP.

(15) The indemnification also covers claims against the Provider as authorised representative of a manufacturer established outside the European Union, in particular arising from product liability, even if it has not assumed this function under § 2, but responsibility is attributed to it by operation of law; this does not constitute a contractual assumption. For products already placed on the market, it continues beyond the end of the contract and mandate.

(16) In the case of Customers outside the European Union for whose products there is no importer in the European Union, the Provider may make the commencement and continuation of its activity as RP conditional on additional security, such as advance payment, bank guarantee or extended proof of insurance; § 16 applies.

(17) The indemnification lapses insofar as the claim is based on a breach of duty by the Provider, and is otherwise reduced according to the mutual shares of causation and fault (Section 254 of the German Civil Code (BGB)). The Provider is indemnified against fines and sanctions only insofar as they are not based on its own culpable conduct and the indemnification does not conflict with the purpose of the sanction.

(18) The Provider shall inform the Customer without undue delay of any claim asserted, give it the opportunity to comment and to take over the defence, and shall not make any acknowledgement or conclude any settlement without its consent. If the Customer unreasonably refuses consent or does not respond within a reasonable period, the Provider may act at its dutiful discretion.

(19) The obligation to indemnify is not limited by the Customer's insurance obligation; it is liable and indemnifies also insofar as its insurance does not pay or the coverage sum is insufficient.

§ 12 Force Majeure and Impediments to Performance

(1) Force majeure is an external event, unforeseeable at the time the contract was concluded, which the affected party is not responsible for and cannot avert by reasonable means. This includes natural events, epidemics, war, terrorism, sovereign measures, failure of communication or energy networks, cyberattacks and labour disputes in which it is not involved.

(2) For the duration of the disruption, the affected performance obligations shall cease to apply. Deadlines shall be extended accordingly. The affected party shall inform the other party without undue delay in text form of the beginning, the expected duration and the end.

(3) If the disruption lasts longer than three months, either party may terminate the affected part of the performance in text form. Section 18 applies to an RP mandate. Prepaid remuneration for services not rendered shall be refunded on a pro rata basis. Damages on account of the disruption itself are excluded.

(4) Section 11 applies to disruptions and changes to the CPNP and SCPN portals as well as to official format or content requirements. Damages on account of mere delay are excluded insofar as the Provider is not responsible for the delay; Section 11 (2) and (3) remain unaffected.

(5) Force majeure does not release the Provider from its mandatory RP obligations. It only suspends the contractual additional services.

§ 13 Term and Termination of Continuing Services

(1) Continuing services are service relationships with fixed remuneration; the remuneration is a fixed, effort-independent flat fee (§ 6). Section 627 BGB therefore does not apply. Should a party nevertheless be entitled to a right of termination under Section 627 BGB, the termination consequences of § 18, including the appointment of a new RP and relabelling, apply upon termination of an RP mandate. The remuneration is then governed by Section 628(1) BGB. The archiving and availability flat fee (§ 18) remains unaffected.

(2) The RP mandate begins with the effective appointment (§ 16) and has a minimum term of 12 months. It is tacitly extended by a further 12 months in each case unless it is terminated in text form subject to a notice period of 3 months to the end of the respective term. The extension only takes effect if the Provider has given a timely reminder in accordance with paragraph 6. Otherwise, the Customer may terminate at any time subject to a notice period of one month to the end of the month. The termination consequences of § 18 apply in that case as well. A late termination takes effect as of the next permissible date.

(3) The EU RP mandate and the UK RP mandate are separate mandates with their own mandate letter, their own remuneration and their own term. They may be terminated separately.

(4) PIF maintenance and the retainer each have a minimum term of 12 months from the commencement of the service. They are tacitly extended by a further 12 months in each case unless they are terminated in text form subject to a notice period of one month to the end of the respective term. Here too, the extension only takes effect upon a timely reminder in accordance with paragraph 6; otherwise the one-month period to the end of the month applies. The termination of one continuing service does not affect the others. The fact that PIF maintenance and the retainer are booked together with an RP mandate does not make them a component of that mandate. If an RP mandate ends, the Provider may terminate the PIF maintenance and the retainer booked for the same products as of the same date if their provision is no longer reasonably possible for the Provider without the mandate.

(5) The right to extraordinary termination for good cause (Sections 314, 626 BGB) remains unaffected for both parties. For the Provider, good cause exists in particular in the case of: a) justified doubts as to the safety or conformity of a mandated product; b) breach of cooperation, notification, reporting or release obligations (§§ 5, 17); c) placing on the market without release (§ 17) or without notification; d) incorrect or incomplete information regarding formulation, nanomaterials or manufacture; e) refusal of required corrective measures (§ 16); f) absence of product liability insurance or proof thereof (§ 17); g) lack of GMP evidence; h) default in payment of more than 30 days after a reminder; i) unauthorised use of the Provider's name or address (§ 18). Termination requires a prior unsuccessful warning or a period allowed for remedy. Both are dispensable insofar as Section 314(2) sentence 3 BGB so provides, in particular in the event of danger to human health or in the case of justified safety doubts. It must be declared within a reasonable period from becoming aware of the cause (Section 314(3) BGB).

(6) The Provider shall remind the Customer in text form of the extension date, the notice period and the termination address no later than 30 days before the start of the respective notice period.

(7) The consequences of the termination of an RP mandate are governed by § 18.

Part B - Special Part (only where the service is booked)

§ 14 Label and Artwork Review

(1) If the label and artwork review is booked, the Provider reviews the version handed over and prepares a review report setting out objections and recommendations for amendment.

(2) The review is carried out against Art. 19 (mandatory information, special rules for small packaging, soaps, bath pearls and non-pre-packaged products, symbols pursuant to Annex VII, list of ingredients pursuant to Art. 33 including order, special rule below 1 percent, colorants and the addition "[nano]", language versions of the target markets named in the offer), against the allergen labelling pursuant to Annex III and Regulation (EU) 2023/1545, as well as against the prohibitions, restrictions, warnings and conditions of use of Annexes II to VI.

(3) Not covered without a separate order are: advertising claims and their substantiation (Art. 20, Regulation (EU) No 655/2013), such as "free from", "hypoallergenic", "natural", "dermatologically tested", as well as sustainability and environmental claims; questions of trademark, design, competition, fair-trading and medicinal advertising law; the delimitation from medicinal products, medical devices, biocides and foodstuffs; national special requirements outside the named target markets; packaging and waste law obligations, recycling symbols, accessibility; print quality, artwork finalisation, colour accuracy and reprint approval.

(4) Only the version handed over is reviewed, on the basis of the legal situation applicable on the day of the review. Any subsequent change requires a new review. Without a new order, there is no obligation to make subsequent corrections in the event of later legal changes.

(5) The review is a professional assessment. It does not guarantee that authorities or competitors will not object to the label. Liability for professional errors remains unaffected pursuant to § 11.

(6) Print approval is always granted by the Customer. Responsibility for label design and printing remains with the Customer. In the case of an RP mandate, § 17 and § 18 additionally apply.

§ 15 Notification (CPNP and UK-SCPN)

(1) If the CPNP notification is booked, the Provider notifies the product in full in accordance with Art. 13 before it is placed on the market. If the UK-SCPN notification is booked, it notifies in the SCPN. The SCPN notification requires an RP established in the United Kingdom: the Provider's partner (§ 16) or the Customer's own UK-RP. The UK services can be booked individually.

(2) If the Provider is the RP, it notifies in its own name under its organisation. If the Customer or a third party is the RP, the Provider notifies in their name on the basis of a separate power of attorney. For this purpose, the Customer grants it a personal access with the necessary rights in its CPNP or SCPN organisation or otherwise establishes the notification authorisation. The Customer's personal access data or passwords are not disclosed. The Provider uses granted access exclusively for the designated purpose.

(3) The Customer owes the information under Art. 13, in particular the product category and name, the name and address of the RP together with the address at which the PIF is accessible, the country of origin in the case of import, the Member States where the product is placed on the market, the contact person, nanomaterials, CMR substances of categories 1A and 1B, the framework formulation, the original label and, to the extent legible, a photograph of the packaging. It vouches for their accuracy. The Provider transfers them carefully and checks their plausibility within the customary professional scope.

(4) The Customer notifies the planned time of placing on the market in good time. The notification must take place beforehand. It reports any change to the notified information without undue delay. The update is included in the RP mandate, to the extent that it is not based on a change to be assessed separately under § 19, and in the PIF maintenance, to the extent that it is based on a change in the law under § 19. Otherwise it must be separately commissioned and remunerated.

(5) The Provider owes the careful and proper transmission, not any success of processing or authorisation. The notification is not an approval and is not examined as to its content. § 11 applies to the portals.

(6) In the case of nanomaterials within the meaning of Art. 16 (§ 5), the separate notification under Art. 16(3) six months before placing on the market is additionally required. It must be separately commissioned and requires complete provision. If the Customer conceals nanomaterials, the Provider is not liable for the resulting infringements and may terminate for cause under § 13.

(7) The EU regime and the British regime are independent. A notification in the CPNP has no effect in Great Britain and vice versa. Northern Ireland is subject to the Cosmetics Regulation and is covered by the CPNP notification and the EU-RP mandate.

§ 16 RP Mandate (EU and UK): Subject Matter, Designation and Position of the Provider

(1) If the RP mandate is booked, the Provider assumes the function of the RP under Art. 4 for the products listed in the mandate letter. It provides the address in the European Union, keeps the PIF available there, makes it accessible to the competent authority and is reachable for authorities during usual business hours. Round-the-clock availability and a particular official outcome are not promised. Response times presuppose the timely supply of information pursuant to § 17.

(2) The UK RP mandate is provided by the Provider via a partner established in the United Kingdom (§ 9). The competent bodies are the Office for Product Safety and Standards and the Trading Standards authorities (Cosmetic Products Enforcement Regulations 2013). EU and British law may diverge; automatic equal treatment is not owed. Divergent British requirements may necessitate a separate Cosmetic Product Safety Report (CPSR), a separate PIF, a separate label version and a change order. The name and address of the UK RP must be stated on the label under British law. The transitional arrangement permits, for at most until 31 December 2027, the statement of a Responsible Person under Art. 19(1)(a) instead, but only for as long as the label bears such a statement; otherwise the UK RP must be stated from the outset. The Customer switches the label to the UK RP within the transitional period, otherwise before the first placing on the market in Great Britain, and bears the costs including artwork and reprinting. The Provider communicates the cut-off date in text form at the commencement of the mandate and upon changes.

(3) The RP mandate only becomes effective upon a separate written mandate letter from the Customer and written acceptance by the Provider (Art. 4(3) to (5)). The form is satisfied by a document signed by the party; a scan or qualified electronic signature suffices. A formal defect does not affect the claim to remuneration for services rendered or the validity of §§ 11 and 18. The mandate letter names the covered products (name, reference, EAN where applicable), the target markets and the commencement of the mandate. EU and UK mandates require separate mandate letters.

(4) The mandate is product- and market-specific; no mandate exists for products not listed. Further products require a supplement to the mandate letter and a separate remuneration agreement.

(5) The Customer warrants that it is entitled to grant the mandate as manufacturer (Art. 4(3) or (4)), importer (Art. 4(5)) or RP by virtue of Art. 4(6). For the covered products, batches and distribution channels, it does not designate any further RP. It discloses any existing RP relationship and terminates it before the mandate becomes effective. In the case of imported products under Art. 4(5), each importer is itself the RP; the Customer discloses such distribution channels before the commencement of the mandate.

(6) Upon the mandate becoming effective, the Provider assumes for the covered products the obligations of the RP, in particular under Art. 5, 7, 11, 13, 21, 22, 23, 24 and 25.

(7) In the internal relationship, the Customer remains responsible and supplies without undue delay the information and evidence required for the Provider's fulfilment of its obligations regarding: a) manufacturer obligations and good manufacturing practice (Art. 8, EN ISO 22716); b) traceability (Art. 7) including identification of the distributors supplied; c) conformity of production with the assessed formulation, Annexes II to VI, batch and quality documentation; d) substantiation of efficacy and advertising claims (Art. 20); e) the prohibition on animal testing (Art. 18); f) product liability; g) distributor obligations (Art. 6); h) all obligations not arising under cosmetics law, for example under packaging, waste, customs, trademark and competition law. The Provider's statutory obligations as RP, in particular under Art. 5(1) and Art. 7, remain unaffected vis-à-vis authorities. In the internal relationship, the Customer remains responsible for safety and conformity.

(8) The RP mandate is a service; § 2 applies.

(9) The Provider may refuse to commence and to continue its activity as RP for as long as the proof of insurance (§ 17), a required data processing agreement (§ 9) or a security pursuant to § 11 is lacking. The contract and the mandate remain effective. If the Provider nevertheless commences the activity, the provisions on remuneration, liability, indemnification and contractual penalty apply without restriction. § 13 remains unaffected.

(10) As RP, the Provider is entitled and obliged to take all measures incumbent upon it under the Cosmetics Regulation, in particular corrective measures, withdrawal and recall (Art. 5(2), Art. 25), notifications (Art. 23), cooperation with market surveillance (Art. 22, 24) and immediate notification of the authorities in the event of a risk to human health (Art. 5(2)). It acts, where possible, after prior information of the Customer, and in cases of imminent danger also without such information and, if necessary, against the Customer's will.

(11) It may refuse the release of a product, a label, a formulation or packaging change, as well as the notification, and revoke a release granted with effect for the future, if there are justified doubts as to safety or conformity or if required documents are lacking.

(12) If the Provider acts pursuant to paragraph 10 or paragraph 11 on the basis of an assessment that is professionally defensible at the time of the decision, the Customer cannot derive any claims therefrom, even if the assessment subsequently proves to be incorrect. If an unjustified measure is based on a culpable breach of duty by the Provider, the Provider is liable pursuant to § 11.

(13) The Provider may demand corrective measures, a distribution stop, withdrawal or recall and set a reasonable deadline for this, adapted to official time limits. In the event of a risk to human health, the Customer initiates the measure without undue delay, at the latest within 48 hours of receipt of the demand, immediately ceases distribution, informs its distributors, provides the traceability data (§ 17) within 24 hours and carries out the measure with the greatest possible expedition in accordance with the official time limits; it cooperates in the implementation.

(14) If the Customer does not comply with a demand under paragraph 13 within the deadline, the Provider may notify the authorities, itself initiate the necessary measures and terminate the mandate for cause; § 13 applies.

(15) The costs of corrective measures, withdrawal, recall, relabelling, destruction, official proceedings, sampling and analyses (Art. 12) are borne by the Customer, insofar as the Provider is not responsible for the measure.

(16) Vis-à-vis authorities, the Provider acts exclusively as RP; any further representation, in particular in administrative fine, administrative or court proceedings, is not owed (§ 2). If the Customer does not supply requested data within the deadline, the Provider is not liable for the resulting failure to meet the deadline, insofar as it is not responsible for it, and may inform the authority of the lack of cooperation.

§ 17 Duties of the Customer under the RP Mandate, Cosmetovigilance and Insurance

(1) Release reservation: The Customer places a mandated product on the market only after release by the Provider in text form. Release requires an SBA-signed CPSR, a complete PIF, an approved label and completed notification.

(2) Notification of changes: The Customer notifies every change before implementation and placing on the market and awaits the renewed release. Subject to the notification duty are in particular changes to the formulation (including in the trace range, the fragrance oil composition or the preservation), raw material supplier, raw material specification, packaging, packaging materials, material contact, label, artwork, product name, type of application or target group (in particular children under three years of age), advertising claims, manufacturing site, batch size and target market.

(3) Availability: The Customer keeps the contact data of its contact person (§ 5) up to date. It answers official inquiries within 3 working days, and without undue delay where a shorter official deadline applies. It forwards without undue delay any communication from authorities, consumers and distributors relating to a mandated product.

(4) Traceability: The Customer maintains batch, quantity and distribution data as well as the data of the distributors supplied (Art. 7) and provides them without undue delay upon request for withdrawal or recall. It communicates the date of placing on the market of the last batch. Without this information, the Provider continues to retain the documents until proof of an earlier start of the period.

(5) Good manufacturing practice: The Customer ensures compliance with good manufacturing practice (Art. 8) and provides proof (EN ISO 22716 or equivalent) upon request. The Provider may request information and inspection of production and documentation records and, insofar as necessary for its RP duties, inspect the manufacturing site after reasonable notice during usual business hours.

(6) Annual confirmation: The Customer confirms annually in text form that the formulation, raw materials, packaging, label and manufacturing are unchanged, or notifies deviations. Silence does not count as confirmation.

(7) Distributors: The Customer ensures that its distributors fulfil the duties under Art. 6. It contractually obliges them to forward undesirable effects and SUE under paragraphs 9 and 10 to the Provider without undue delay, and demonstrates this upon request. The distributors' own reporting duty under Art. 23(1) remains unaffected.

(8) As the Responsible Person, the Provider reports every SUE without undue delay to the competent authority of the Member State in which it occurred (Art. 23), at the latest within 20 calendar days of an employee of the RP or a distributor becoming aware. As between the parties, the knowledge of the Customer, its employees and its distributors triggers the period; the Customer bears the risk of the shortening of the period and of delayed forwarding.

(9) The Customer forwards without undue delay, at the latest within 24 hours of becoming aware, every SUE that has come to the knowledge of it, its distributors or its customer service; every other undesirable effect and every relevant complaint within 5 working days. The report contains at least the product designation, batch number, time and place of occurrence, the available information on the person concerned and on the course of events, and the available documents.

(10) The Customer cooperates without undue delay, at the latest within 5 working days of the request, in follow-up reports, causality assessment and root cause investigation.

(11) The Provider is not liable for missed deadlines resulting from delayed, incomplete or incorrect forwarding by the Customer or its distributors, insofar as it is not responsible for them. It makes data on undesirable effects available to the public in accordance with Art. 21 (§ 9); § 9 applies to health data.

(12) Insurance: During the term of each RP mandate, the Customer maintains product liability insurance of at least EUR 1,000,000 per claim and EUR 2,000,000 per insurance year, covering extended product liability including recall and replacement costs; deviating coverage sums appropriate to the product risk and market scope may be agreed in the offer. Its absence entitles the Provider to refuse activity (§ 16), to suspend non-mandatory services (§ 6) and to terminate for cause (§ 13), but leaves the validity of the mandate unaffected.

(13) The Customer proves the insurance before the start of the mandate by insurer confirmation, thereafter annually without being requested and within 14 days upon request. It notifies without undue delay in text form any termination, non-renewal or material restriction of the cover. Upon request, it proves that claims against the Provider as the Responsible Person are covered, or cooperates in a co-insurance. After the end of the mandate, it maintains the cover for ten years from the placing on the market of the last batch or, within 14 days, proves run-off liability cover in the same amount. § 11 applies.

(14) The breach of a duty under paragraphs 1 to 13 may constitute good cause for termination for cause under § 13; the warning requirement and the balancing of interests set out there apply. It triggers the indemnification under § 11 and obliges the Customer to pay damages in accordance with the statutory provisions. A suspension of the Provider's statutory duties as the Responsible Person is not agreed.

(15) If only the retainer and not the RP mandate is booked, paragraphs 3, 4 and 9 to 11 apply accordingly. Paragraph 8 then applies only insofar as the Provider is authorised by the Customer or its RP; in all other respects, the duties under Art. 21 and 23 remain with the Responsible Person.

§ 18 Use of the Provider's name and address; Termination of the RP mandate

(1) For the duration of the RP mandate, the Customer may use the name and address of the Provider or of the UK partner pursuant to Art. 19(1)(a) and the British provisions on the container, on the packaging and in the notification. The permission is non-exclusive, non-transferable and revocable.

(2) It applies only to the products listed in the mandate letter, in the approved spelling and for the approved formulation, packaging and label version. Printing and reprinting require the Provider's artwork approval in text form.

(3) Prohibited are in particular the use for non-mandated products, batches or markets, for amended formulations without approval, after the end of the mandate, as well as in marketplace offers, shops or advertising material without approval. Furthermore, any presentation of the Provider as manufacturer, quasi-manufacturer or economic operator (§ 2) is prohibited.

(4) In the case of good cause pursuant to § 13, the Provider may revoke the permission with effect for the future.

(5) In the case of use contrary to paragraph 2 or paragraph 3, the Customer owes cessation, recall and re-labelling of the affected goods at its own expense, damages and indemnification (§ 11). Furthermore, for each culpable infringement it forfeits a contractual penalty of 5,000 euros, in total at most 50,000 euros per calendar year and at most in the amount of the remuneration paid for the affected mandate in the last twelve months, but at least 5,000 euros. Upon the Customer's application, it may be reduced by the court to a reasonable amount; Section 348 of the German Commercial Code (HGB) is excluded in this respect. Infringements arising from the same act or artwork version are deemed to be one. The contractual penalty is set off against claims for damages; further claims remain unaffected, subject to set-off.

(6) The Provider's trademark rights are not transferred; no right to use REGULARUS or CONIUNCTA for advertising arises.

(7) By the time the termination takes effect at the latest, the Customer must appoint a new RP and notify this in text form, change over the label, arrange re-labelling or reprinting at its own expense and arrange the re-notification by the new RP. The notice period of 3 months (§ 13) is provided for this; paragraph 14 applies.

(8) Within 15 working days of request, the Provider shall hand over to the Customer or the new RP the complete PIF including CPSR and notification data in a common, reusable electronic format, shall issue the declarations required for the transfer and shall update or close its CPNP or SCPN data set. The effort for export, handover and notification is remunerated at the hourly rate shown in the offer; a lump sum may be shown in the offer. § 20 applies.

(9) From when the termination takes effect, the Customer may no longer place on the market for the first time any goods bearing the name or address of the Provider or of the UK partner. Sell-off planning and timely re-labelling fall within its area of responsibility and must be completed before the expiry of the period.

(10) For goods already placed on the market bearing the name or address of the Provider or of the UK partner, the Provider remains the RP to that extent. It keeps the PIF available during the ten-year period, remains reachable for authorities and continues to fulfil its statutory obligations, in particular Art. 5, 7, 13, 21, 22 to 25, irrespective of any remuneration agreement and payment. For this, the Customer owes an annual archiving and availability flat fee, billed in advance, in the amount specified in the offer, otherwise at the hourly rate shown there. It is owed for the duration of the ten-year period; § 7 applies accordingly. Further effort is remunerated at the hourly rate (§ 6). The Customer may terminate the service as soon as it proves the expiry of the period. For these goods, it remains obliged to supply and cooperate pursuant to § 16 and § 17.

(11) If the Customer does not appoint a new RP by the end of the period, the Provider may, after announcement and expiry of a grace period of at least 10 working days: a) inform the authorities and CPNP or SCPN that it is no longer the RP, and update or close the notification data set or mark the product as no longer placed on the market; b) request the Customer to cease the placing on the market without delay; c) continue the mandate against a transitional fee to be agreed separately and shown in the offer for at most 3 further months, insofar as this is necessary to avoid a regulatorily impermissible state. There is no obligation of the Provider to continue and no claim of the Customer thereto.

(12) The failure to appoint does not bind the Provider to the mandate. The Customer bears all consequences, in particular distribution stop, withdrawal, recall, measures by authorities and third-party claims, indemnifies the Provider pursuant to § 11 and compensates the damage in accordance with the statutory provisions.

(13) The obligation to retain the PIF during the ten-year period continues to exist irrespective of the end of the contract (§ 17, § 20). The indemnification obligation (§ 11) and the insurance obligation (§ 17) continue to exist for products already placed on the market beyond the end of the mandate.

(14) If a party terminates an RP mandate pursuant to a provision of these GTC whose effect would take place before the expiry of three months from receipt of the termination (§ 7, § 9, § 12, § 13, § 20), the termination takes effect at the earliest three months after receipt. Until then, the Provider continues the mandate on the previous terms and at the previous remuneration; an announced price increase or GTC amendment does not apply for this period. The termination consequences pursuant to paragraphs 7 to 13 are to be implemented in this period. Extraordinary termination pursuant to § 13 remains unaffected; in that case paragraph 11 applies.

§ 19 PIF maintenance, amendment service and retainer

(1) If PIF maintenance (also PIF maintenance) is booked, the Provider carries out a review annually on the agreed reference date: reconciliation of the product against amended Annexes, new amending regulations and SCCS opinions, assessment of the effects, updating of the affected documents (CPSR, PIF, INCI label proposal, notification) and a report to the Customer.

(2) Not included without a separate order are laboratory analyses, procurement of new toxicological data, research and assessment of substitute substances, reformulation, reassessment of amended formulations, packaging or applications (paragraphs 7 to 11 apply to these), procurement of supplier documents beyond the agreed scope, as well as reprinting and relabelling.

(3) A prerequisite is the Customer's annual confirmation in text form that the formulation, raw materials, packaging, label and manufacture are unchanged. The Provider sends one reminder in text form. If it is not provided, the maintenance is suspended for the affected cycle. The Provider is not liable for any non-conformity resulting therefrom, insofar as he is not responsible for it. The claim to remuneration for the current period remains in place, less saved expenses. If an RP mandate exists at the same time, the Provider's statutory obligations as RP remain unaffected, in particular updating the safety assessment (Art. 10) and keeping an up-to-date PIF available (Art. 11). He may invoice the additional expenditure under § 6 and terminate the mandate for cause under § 13.

(4) Without booked PIF maintenance, the Provider does not monitor changes in the law (§ 5). His statutory obligations under the RP mandate remain unaffected.

(5) PIF maintenance does not guarantee continued conformity and is based on the information provided by the Customer. Implementation deadlines of the Customer, for example under Regulation (EU) 2023/1545, are thereby neither extended nor deferred and do not replace his own duty to monitor and implement.

(6) PIF maintenance is a service; no acceptance of the standby and monitoring service takes place. For the documents created or updated (CPSR, PIF, INCI label proposal, notification data record), § 8 applies accordingly.

(7) If the amendment service is booked, the Provider assesses the effects of a change to the formulation, raw materials, suppliers, packaging, application, target market or legal situation. He updates the affected work results, in particular the CPSR, PIF, notification, INCI label proposal and, where booked, the label review report.

(8) It covers adjustments after acceptance or during an ongoing continuing obligation and is to be distinguished from the correction loops included in the fixed price under § 6. Every other change initiated by the Customer and every reassessment after release must be commissioned and remunerated separately, insofar as it does not form part of a booked PIF maintenance. Not owed are reformulation, substitute raw materials, new toxicological data, laboratory work and reprinting of labels.

(9) Remuneration is based on the model agreed in the offer, either as a single order or as a quota. A quota applies for one contract year, is invoiced in advance and does not renew tacitly. For the due date, § 6 applies; for the carry-over of unused hours, paragraph 14. In derogation from paragraph 14 sentence 2, unused hours of an amendment service quota do not lapse without compensation; upon expiry of the carry-over period, they are, at the Customer's request, reimbursed to him on a pro-rata basis at the agreed hourly rate or credited against other services of the Provider. A quota does not turn the amendment service into a continuing service; § 13 does not apply.

(10) If an RP mandate exists, the Customer may implement a change and place it on the market only after renewed assessment and release (§ 17).

(11) The amendment service is a work performance; § 8 applies.

(12) If the retainer is booked, the Provider keeps the regulatory reporting and communication channels available. It covers receipt, documentation and technical assessment of undesirable and serious undesirable effects, maintaining the documentation, reporting serious undesirable effects under Art. 23, insofar as the Provider is the RP or authorised for this purpose, as well as receipt and technical-regulatory answering of authority inquiries.

(13) The retainer is remunerated as a standby service. The hour quota shown in the offer per contract year designates the scope of work that can be called off without additional remuneration. The Provider responds to a report or authority inquiry during usual business hours within 2 working days with an initial response. A particular processing or resolution time is not promised.

(14) Unused hours are carried over once into the following billing period, at most to the extent of a full annual quota. A carry-over beyond two periods and a payout do not take place. Effort beyond the quota is remunerated at the hourly rate stated in the offer; § 6 applies accordingly.

(15) The Customer fulfils the reporting, supply and cooperation obligations under § 17 even if only the retainer is booked. In that case, he must also contractually impose on his distributors the forwarding of undesirable effects (§ 17). § 17 and § 16 apply accordingly.

(16) The Provider provides regulatory expert advice, not legal services (§ 2); legal representation and defence are incumbent on the Customer. The Customer bears the costs of official proceedings, sampling and analyses (Art. 12), insofar as they are not attributable to the Provider.

(17) The retainer is a service; § 2 applies.

Part C - Common Provisions and Final Provisions

§ 20 Retention, Amendments to these GTC and Final Provisions

(1) During an RP mandate, the Provider keeps the PIF available at the address indicated on the label and makes it easily accessible to the competent authority. If an authority requests the PIF or parts of it in another language, the Provider arranges the translation without undue delay; the Customer bears the costs based on effort at the hourly rate stated in the offer or according to the costs of the translation service provider. Its statutory RP obligation remains unaffected.

(2) The PIF must be retained for ten years from the placing on the market of the last batch; this period outlasts the mandate. The Provider is entitled and obliged to retain copies of the PIF and of all regulatory processes until the expiry of the period; this takes precedence over the deletion and confidentiality provisions of § 9.

(3) Upon termination of an RP mandate, § 18 applies.

(4) Without an RP mandate, the Provider is only entitled, not obliged, to retain the work results; the Customer's statutory retention obligation remains unaffected. The Provider may delete the documents three years after completion of the order, notifies the Customer thereof beforehand in text form and gives the Customer the opportunity to retrieve them. The Provider retains the audit log relating to the work results for ten years from completion of the order and makes it available to the Customer upon request.

(5) There is no right of retention over mandatory regulatory documents, in particular over the PIF, insofar as it would impede their submission to authorities.

(6) The Provider may amend these GTC for current continuing obligations, insofar as this is necessary to adapt to a change in the legal situation, to supreme court case law issued after conclusion of the contract or to binding official requirements, or closes a gap in the provisions that arose after conclusion of the contract, the failure to fill which would impede the performance of the contract to a not insignificant extent. The ratio of performance and consideration must not thereby shift to the detriment of the Customer. Excluded are the main performance obligations and the remuneration; price changes are governed exclusively by § 7.

(7) The Provider announces the amendment in text form at least 6 weeks before it takes effect, juxtaposes the previous and the new version, and points out the objection period of 6 weeks as well as the fact that silence is deemed consent. If this notice is missing, the fiction of consent does not arise.

(8) If the Customer does not object within 6 weeks of receipt of the announcement in text form, the amendment is deemed agreed. The fiction of consent applies only to non-disadvantageous amendments; all others require the Customer's express consent in text form.

(9) If the Customer does not grant consent or objects in due time, the amendment is deemed not agreed. The Provider may then terminate the affected continuing service at the next possible ordinary termination date; the Customer has a special right of termination as of the time the amendment takes effect. For an RP mandate, § 18 applies.

(10) The Provider may change the scope of services of a continuing service, insofar as changes in the legal situation, in binding official requirements or in the state of science and technology give cause for this and it is reasonable for the Customer; the Provider announces this in text form at least 6 weeks in advance and states the reason. In the case of a not merely insignificant restriction, the Customer may terminate the affected service in text form as of the time it takes effect. For an RP mandate, § 18 applies.

(11) The Provider keeps earlier versions of these GTC retrievable with a version identifier at a stable address.

(12) This version applies to platform orders (§ 21) and to contracts based on an offer submitted on or after 10 October 2026 that refers to this version. For other offers, edition 2.0 of 15 July 2026 continues to apply. For contracts based on an earlier offer, the previous version continues to apply until the parties agree in text form on the applicability of this version or conclude a new specification sheet. It applies to existing continuing services only with the Customer's consent in text form; paragraphs 6 to 10 remain unaffected.

(13) The contract language is German; only the German version is legally binding. Versions in other languages serve only for comprehensibility; in the event of discrepancies, the German version prevails.

(14) German law applies to the exclusion of the UN Convention on Contracts for the International Sale of Goods. Mandatory public-law obligations of the respective target market, in particular the British regulations on cosmetic products, remain unaffected.

(15) The place of performance is the registered office of the Provider, unless mandatorily determined otherwise. The place of jurisdiction for all disputes arising out of or in connection with the contractual relationship is Nuremberg, provided that the Customer is a merchant, a legal person under public law or a special fund under public law.

(16) If the assurance of entrepreneur status (§ 1) proves to be incorrect, the Provider may withdraw from the contract; statutory rights of rescission remain unaffected.

(17) The Customer may assign rights and claims arising from the contract only with the prior consent of the Provider in text form; consent must not be unreasonably withheld. Section 354a of the German Commercial Code (HGB) remains unaffected.

(18) The Provider may transfer the contract with all rights and obligations to an affiliated company and announces this in text form at least 6 weeks in advance. The Customer may object in text form within 4 weeks of receipt; in that case the Provider remains the contracting party, and the Customer may extraordinarily terminate the affected service as of the intended time of transfer. For an RP mandate, § 18 applies. If, in the case of an RP mandate, the transfer changes the name or address of the RP, § 9 applies accordingly to the costs of relabelling.

(19) If individual provisions are invalid, the remainder of the contract remains valid; the statutory provision takes the place of the invalid provision. A validity-preserving reduction does not take place.

(20) There are no oral collateral agreements. Individual contractual agreements take precedence and are not subject to any formal requirement (§ 1).

Part D - Orders via the REGULARUS Platform

§ 21 Scope, Platform and Customer Account

(1) Part D applies to orders placed by the Customer via the Provider's online platform ("platform order"). For platform orders, Part D, the order summary and the declaration of acceptance take precedence over Parts A and B; otherwise Parts A to C apply.

(2) The questionnaire, the price calculation and the preparation of documents are free of charge and non-binding. To upload documents and to place an order, the Customer creates a customer account. Sign-in takes place via a sign-in link that the Provider sends to the email address on file. The Customer protects access to its email account against unauthorised use and keeps its details up to date. The free preparation includes status messages and reminders of open steps by email; the Customer can unsubscribe from reminders at any time in the customer account or via the link in the email.

(3) The platform is directed exclusively at entrepreneurs, including business founders (§ 1(2)). The Customer confirms this when placing the order; § 20(16) applies.

(4) The Customer uploads only documents that it is entitled to pass on for the order. Malware and content obviously not intended for the order are not permitted. The Provider may remove such content and block access in the event of misuse.

(5) The Provider operates the platform with customary care. There is no entitlement to uninterrupted availability. The Provider announces maintenance in advance where possible.

§ 22 Packages and Scope of Services

(1) The Customer chooses one of the following packages; the service description in the order summary is decisive: a) "Report only": CPSR (Part A and B) and INCI label proposal pursuant to § 4(1) and (2), a template for the PIF which the Customer completes, and the notification assistance pursuant to § 4(3) as step-by-step instructions; in derogation from § 4(1), the Provider does not prepare a complete PIF. b) "Complete": core service pursuant to § 4 (PIF, CPSR, INCI label proposal), a label specification with the mandatory particulars pursuant to Art. 19, the label and artwork review pursuant to § 14 for the label draft of each variety including one re-check of the corrected version, and the CPNP notification pursuant to § 15. c) "Complete plus service": services as for "Complete"; in addition, the Provider requests missing documents from the Customer's manufacturers and suppliers, follows up on the requests and evaluates the replies. What is owed is the effort, not the receipt of the documents; § 2(4) and (6) and § 5(5) do not apply in this respect. d) "Soap kit": CPSR (Part A and B) and INCI label proposal for solid soap according to the Customer's recipe, where the varieties differ only in fragrances and colours from the list approved by the Provider; otherwise as for "Report only". If the Customer uses other fragrance materials, the scope of services and the price of the "Report only" package apply.

(2) The Provider prepares one CPSR per recipe. Varieties of the same recipe that differ only in fragrance or colour are assessed within it. Any other difference makes the variety a recipe of its own.

(3) Additional services, insofar as booked in the order summary: a) review of the advertising claims per variety pursuant to Art. 20 and Regulation (EU) No 655/2013 with a written assessment and reasons; § 2(4) and § 14(3) do not apply in this respect; b) Express pursuant to § 25(3); c) stability test pursuant to § 26; d) documents for Great Britain: adaptation of the safety report and the PIF to British law, data for the SCPN notification and a labelling specification for Great Britain; the notification itself requires a UK RP (§ 15(1)), and the Provider does not provide a UK RP via the platform; e) representation in the EU pursuant to § 27; f) surcharges for products intended for children under three years of age and for wipes or pads impregnated with the product.

(4) In derogation from § 5(1), for fragrance oils and for essential oils used as fragrance, the IFRA certificate of conformity and the supplier's allergen declaration are sufficient. The complete composition is only required if the SBA requests it in the individual case.

(5) An AI-supported review assistant assigns uploaded documents to the requirements and checks them for completeness and suitability. Its feedback is neither a safety assessment nor advice; the safety assessment is carried out solely by the SBA. Before the order is placed, the number of automatic pre-checks per customer account is limited.

§ 23 Documents, Requests to Manufacturers and Suppliers

(1) The Customer uploads the documents pursuant to § 5 on the platform; the platform shows which documents are still missing. The Customer may submit the label draft after sending the documents to the SBA.

(2) At the Customer's request, the Provider requests missing documents from the manufacturers or suppliers named by the Customer. It writes on behalf of the Customer, names the Customer and, as a rule, sends reminders after three and after seven days. What is owed is the request and the reminder, not the receipt of the documents; their completeness remains the Customer's responsibility (§ 5). The Customer warrants that it may pass on the recipient's contact details and have the request made on its behalf.

(3) Documents that manufacturers or suppliers upload directly via the link sent to them are accessible only to the Provider and the SBA. The Customer sees which documents have been received, but not their content. § 9 applies.

§ 24 Fixed Price, Conclusion of Contract and Reservation regarding the Price Level

(1) The prices calculated on the platform are fixed prices for the stated characteristics, in particular product types, number of recipes and varieties, package and additional services. They are valid for 30 days from the calculation.

(2) By clicking "Order with obligation to pay" ("Zahlungspflichtig beauftragen"), the Customer submits a binding offer for the services stated in the order summary. Before doing so, it can check and correct its details in the order summary. The Provider confirms receipt automatically; the confirmation of receipt is not an acceptance.

(3) The contract is concluded upon acceptance by the Provider in text form. The Provider declares acceptance after a professionally qualified person has reviewed the documents, within four working days of receipt of the offer; until then the Customer is bound by its offer. If acceptance is not declared in time, the offer lapses; the Customer is then not charged.

(4) If the review shows that a different price level, a different number of recipes or varieties or a surcharge applies, the Provider rejects the offer and submits a new offer at the fixed price according to the price list applicable at the time of calculation. The Customer can accept or reject it on the platform; if it rejects, it incurs no costs.

(5) The Provider may refuse acceptance, in particular if the product is not a cosmetic product or lies outside the scope of the platform. The Customer is then not charged.

(6) The Provider stores the text of the contract. The Customer can retrieve and save the order summary, the declaration of acceptance and these GTC in its customer account. § 20(13) applies to the contract language.

§ 25 Prices, Payment, Delivery Period and Express

(1) The prices of the platform price list at the time of calculation (§ 24(1)) apply, net plus statutory value added tax. For customers in another EU Member State with a valid VAT identification number and for customers outside the EU, no German value added tax is charged, insofar as the statutory requirements are met.

(2) Volume discount: from 5, 10 and 20 varieties per platform order, the Provider grants 10, 15 and 20 per cent respectively on the prices for package and varieties. The service surcharge, surcharges pursuant to § 22(3)(f), the soap kit, the review of advertising claims, the stability test and the documents for Great Britain are not discounted.

(3) With Express, the delivery period pursuant to paragraph 5 is reduced to five working days. The surcharge amounts to 35 per cent of the package price, i.e. the prices for package, varieties, service surcharge and surcharges after deduction of the volume discount. If the Provider fails to meet the Express period for reasons for which it is responsible, it refunds the surcharge; further claims are governed by § 11.

(4) The Customer pays via the payment service offered on the platform by card, PayPal or SEPA direct debit. With the offer pursuant to § 24(2), the amount is reserved or the direct debit mandate is granted; the Customer is only charged upon conclusion of the contract. In derogation from § 6(1), the remuneration is due upon conclusion of the contract. The Provider makes the invoice available electronically in the customer account and by email.

(5) The Provider makes the work results of the booked package available within ten working days after the complete documents have been sent to the SBA (delivery period). Working days are Monday to Friday, excluding statutory public holidays at the Provider's registered office. The period is extended by the time from a query by the SBA until the Customer's complete answer; the Customer answers queries within the period stated on the platform. If a stability test is booked, the period begins when the test result is available. Label review and notification follow after receipt of the label draft. § 3(5) does not apply to platform orders.

(6) The Provider makes the work results available in the customer account as PDF in the chosen report language. The review period pursuant to § 8(2) begins upon making them available.

§ 26 Stability Test

(1) If the stability test is booked, the Provider tests the stability of the product per recipe in its laboratory over twelve weeks under accelerated conditions, in particular at different temperatures, according to the test plan described in the test report, and prepares a test report. A preservative efficacy test (challenge test) is not included.

(2) The Customer sends six units per recipe in the sales packaging at its own expense to the address stated in the declaration of acceptance. The test samples are consumed and not returned. The twelve weeks begin upon receipt of the samples.

(3) The stability test is a contract for work; § 8 applies. What is owed is proper performance and documentation, not a particular result. If the test shows that the product is not sufficiently stable in the tested form, the remuneration for the test remains owed; a changed formulation is a new subject of assessment (§ 6(2)).

§ 27 Representation in the EU via the Platform

(1) If the Customer books representation in the EU, §§ 16 to 18 apply. The RP mandate only becomes effective with the mandate letter and acceptance in the form of § 16(3); the Provider makes the mandate letter available in the customer account.

(2) The remuneration is an annual flat fee according to the platform price list, consisting of a base amount and amounts per recipe and per additional variety; for customers with their registered office outside the EU, the amounts shown there apply. In derogation from § 6(3), invoicing is annual in advance, for the first time when the mandate becomes effective.

(3) The term and termination are governed by § 13(2). PIF maintenance for the mandated products is included in the representation. The obligations pursuant to § 17, in particular the approval reservation and proof of insurance, remain unaffected.