Skip to content

Terms of Service

Version: 1.0 · Last updated: 2026-10-05

Preamble

These Terms of Service ("Terms") govern the contractual relationship between

ShellRoom
Mario Fasold
Sternwartenstr. 29
04103 Leipzig
Germany

("ShellRoom", “we”, “us” or “our”) and the customer named in the order or completing the registration ("Customer", “you”).

ShellRoom develops and operates software that enables Customers to run terminal-based, practical training exercises in a browser, using a training environment that the Customer itself prepares on a server it controls. These Terms apply to the ShellRoom CLI Agent, the ShellRoom Web Applications, and any related services (together, the “Services”).

By installing, accessing or using the Services — including by clicking an acceptance checkbox during registration or checkout — you declare your agreement to these Terms. If you do not agree, you must not use the Services.

1. Definitions and Interpretation

1.1 Capitalised terms have the meanings given below.

  • “Account” means the account of the Customer in the Web Applications used to manage users, plans and Auth Keys.
  • “Authorized User” means a Trainer or Participant whom the Customer has authorised to use the Services under its Account, and for whom the Customer is responsible.
  • “Auth Key” (or “Auth Token”) means the authentication credential issued through the Web Applications that binds a deployment of the ShellRoom CLI Agent to an Account and a plan.
  • “Business Customer” means a Customer that is an entrepreneur within the meaning of § 14 BGB, a legal person under public law, or a special fund under public law.
  • “Consumer” means a Customer that is a natural person acting for purposes that are predominantly outside that person’s trade, business or profession (§ 13 BGB).
  • “Customer Data” means all data, information and content that the Customer or its Authorized Users submit to, or that is processed through, the Services, including participant names or usernames, connection data and the input and output of Terminal Sessions.
  • “Free Plan” means the plan permitting the use of the Services free of charge, limited as described in Section 6.
  • “Paid Plan” means a paid subscription plan, as further described in Section 7 and on our pricing page.
  • “Participant” means an individual attending a training conducted by the Customer and using the Services to complete practical exercises.
  • “ShellRoom CLI Agent” means the downloadable CLI tool, together with any updates and documentation we make available.
  • “Services” means the ShellRoom CLI Agent, the Web Applications, and any related services we provide.
  • “Terminal Session” means a browser-based terminal session established through the Services.
  • “Trainer” means the individual who prepares and conducts training and who uses the ShellRoom CLI Agent on the Training Server.
  • “Training Server” means the server (for example a VPS or other Linux machine) that the Customer prepares, configures, pays for and controls, on which the ShellRoom CLI Agent is installed and on which training takes place.
  • “Virtual Login Mode” means the usage mode described in Section 5, in which the ShellRoom CLI Agent presents a virtual login screen instead of using operating-system user accounts.
  • “Web Applications” means the hosted web applications that manage users, subscriptions and Auth Keys and that establish and relay browser-based Terminal Sessions, together with any other online services we provide.

1.2 Interpretation. Headings are for convenience only. “Including” means “including without limitation”. A reference to a statute includes amendments to it. Where a term is defined in the text and also in Section 1, the definition in the body of the provision prevails for that provision.

2. Scope, Parties and Contractual Relationship

2.1 Contracting party is the Customer. The contractual relationship under these Terms is formed solely with the Customer — normally the trainer, host, course provider or organisation that prepares the Training Server and manages the Account. Participants are not parties to this agreement.

2.2 Responsibility for Authorized Users. The Customer is responsible for:

(a) selecting, registering and administering its Authorized Users; (b) ensuring that all Authorized Users comply with these Terms and with applicable law; and (c) all use of the Services that occurs through its Account, its Auth Keys or its Training Server, whether or not authorised by the Customer.

2.3 Nature of the Customer’s role. Where the Customer is the organiser of a training and determines the purposes and means of processing Participant data, the Customer is the controller and ShellRoom acts as its processor for that data. Section 11 and any separate data processing agreement apply.

2.4 Consumers and Businesses. These Terms apply to Business Customers and to Consumers alike. Where the Customer is a Consumer, mandatory statutory consumer-protection rules apply and take precedence over any conflicting provision of these Terms.

3. The Services; What ShellRoom Provides and Does Not Provide

3.1 What ShellRoom provides. ShellRoom provides software and hosted infrastructure that enables browser-based terminal access to a training environment prepared and controlled by the Customer, together with account management. The Services complement teaching delivered through third-party conferencing systems (for example Zoom); those third-party systems are not part of the Services.

3.2 Components. The Services consist of two components:

(a) the ShellRoom CLI Agent, which the Customer downloads and installs on the Training Server; and (b) the Web Applications, which manage users and establish and relay browser-based Terminal Sessions.

3.3 What ShellRoom does not provide. ShellRoom does not:

(a) provide, host, operate or administer the Training Server; (b) install, configure or license the Customer’s study software, tools, packages or data; (c) administer the Customer’s Linux system, user accounts or security generally; (d) guarantee that a given Training Server configuration is suitable for a particular course, class size, dataset or workload; (e) provide the teaching itself, course content or a conferencing system; or (f) act as a backup or disaster-recovery service for the Customer’s environment or data.

3.4 No advisory relationship. We do not provide legal, IT-security, data-protection, tax or other professional advice through the Services. The Customer remains responsible for assessing the suitability, security and legality of its own environment and courses.

3.5 Preview and experimental features. Features labelled “beta”, “preview” or similar may be changed or discontinued at any time and may be excluded from warranties and availability commitments.

4. The Training Server and Privileged Setup Operations

4.1 Customer control and authority. The Customer is solely responsible for the Training Server. The Customer represents and warrants that it:

(a) owns or is otherwise authorised to administer the Training Server, including the right to create operating-system user accounts on it; (b) has the necessary permissions and authority to install and run the ShellRoom CLI Agent on it; and (c) will comply with all laws and third-party terms applicable to it, including the terms of any hosting provider.

4.2 Privileged setup operations. To operate, the ShellRoom setup tool is designed to perform administrative actions on the Training Server, including:

(a) creating a Linux user account for each person listed in the Customer’s user table; (b) copying skeleton data and files into those accounts’ home directories; and (c) modifying login configuration so that users automatically join the ShellRoom session after login.

These actions require elevated privileges, typically sudo/root. The Customer is responsible for reviewing whether these operations are appropriate and safe for its system, and for the consequences of executing them, before running the setup tool. The Customer must satisfy itself that the actions do not conflict with other users, services, existing configuration or compliance requirements on that machine.

4.3 Ongoing Customer responsibilities. The Customer is responsible, at its own expense, for operating, securing and maintaining the Training Server, including:

(a) operating-system security, hardening and patching; (b) SSH configuration and access management; (c) firewalling, network configuration and exposure of services; (d) installing, updating and licensing any packages, tools, software and datasets used in the training; (e) storage, capacity, performance and any VPS/hosting costs; (f) creating and maintaining backups of the Customer’s own data and configuration; and (g) compliance with any obligations relating to the data placed on the Training Server.

4.4 Third-party software and data. Any third-party software, code, datasets or content installed on the Training Server are licensed and governed solely between the Customer and the relevant third party. We grant no rights to such materials and assume no responsibility for them.

4.5 Suitability. We do not warrant that the Services will be compatible with, or perform adequately on, any particular Training Server, distribution, kernel, container setup or workload. Performance depends on the Customer’s configuration, resources and network.

5. Virtual Login Mode — Special Conditions

5.1 Nature of Virtual Login Mode. Virtual Login Mode is a mode of the ShellRoom CLI Agent. Instead of relying on operating-system user accounts, it presents a custom login form. The ShellRoom CLI Agent verifies the entered credentials against the user table that the Customer has supplied to it, and upon successful authentication the web terminal shows a shell that is spawned by the ShellRoom CLI Agent under the same operating-system account that launched the CLI Agent, while assigning the logged-in person their virtual user name. Demo Mode is a use case of Virtual Login Mode.

5.2 No operating-system isolation between users. The defining characteristic of Virtual Login Mode is that it authenticates users at the application level but does not create separate operating-system accounts. All Terminal Sessions therefore run as the same operating-system user that launched the CLI Agent, and participants may have access to the same filesystem permissions, environment, processes and resources available to that account. Before using Virtual Login Mode for a real training, the Customer must ensure that the launching account is appropriately restricted and configured with least privilege for its participants, and must assess whether this access model matches the trust level of its participants and the sensitivity of the data and systems involved.

5.3 Credentials. In Virtual Login Mode, login credentials are verified by the ShellRoom CLI Agent against the user table provided by the Customer. The Customer is responsible for defining those credentials, for their strength and for their secure handling, and should not reuse them for other services. In Demo Mode, ShellRoom ships with a number of predefined users and passwords. Those predefined credentials are not confidential authentication credentials and must not be treated as such; they provide no meaningful protection for information of value.

5.4 Intended scope. Virtual Login Mode is intended for training scenarios in which participants may be trusted with the access level of the launching operating-system account. It is not intended for scenarios in which participants must be isolated from one another at the operating-system level, or in which data or systems reachable by the launching account must be protected from a participant who has been given a login. Where such isolation or separation between participants is required, the Customer must instead use the per-user operating-system setup described in Section 4. The Customer is responsible for assessing whether Virtual Login Mode is suitable for a given training.

6. Authorized Users, Plans and Usage Limits

6.1 Authorized Users. The Customer may assign each Authorized User either the functional role “Trainer” or “Participant”. Each Authorized User must use the Services only within the scope of the Customer’s plan and these Terms.

6.2 Free Plan. The Free Plan allows the use of the Services free of charge for a training session with up to five simultaneous users, whether Trainers or Participants.

6.3 Paid Plans. Paid Plan subscriptions are available under the plans and at the prices shown on our pricing page.

6.4 Counting users. A user counts toward the applicable limit when that user is admitted to a Terminal Session.

6.5 Adjustments. The Customer may increase (upgrade) its plan at any time. Downgrades take take effect at the end of the current billing period.

7. Subscription, Fees, Billing and Cancellation

7.1 Subscription model. Paid Plans are offered on a month-to-month basis, with no fixed minimum term.

7.2 Fees and taxes. The Customer agrees to pay the fees for the plan it selects. All prices shown to the Customer include statutory value-added tax and any other price components, if applicable. Invoices to Business Customers show the net amount and the applicable VAT separately.

7.3 Payment authorisation. By providing a payment method, the Customer authorises us (or our payment processor) to charge the fees for the selected plan, including recurring subscription fees and applicable taxes, to that payment method in advance of each billing period. We use third-party payment processors such as Stripe. The Customer must keep its payment information current.

7.4 Renewal. A subscription renews automatically for a further monthly period unless it is cancelled before the next renewal date. Renewal occurs at our then-current price for the plan, subject to Section 7.7.

7.5 Cancellation. The Customer may cancel its subscription at any time in the Web Applications, effective at the end of the then-current billing period. On cancellation, at the end of the paid period the Account falls back to the Free Plan.

7.6 No partial refunds. Fees are charged for full months. If the Customer cancels, unused time within the current period is not refunded or credited. This does not affect any mandatory statutory rights of the Customer, in particular any consumer rights (Section 18.11).

7.7 Price changes. We may change prices for future billing periods. We will notify the Customer in advance in text form (by email). If the Customer does not agree, it may cancel before the change takes effect as described in Section 7.5.

7.8 Overdue amounts. We may suspend or restrict access for Accounts that are past due. We may charge reasonable reminder or processing fees to the extent permitted by law, and may engage a collection agency for overdue receivables. Statutory limits, in particular those protecting Consumers, remain unaffected.

7.9 Credits and promotions. We may revoke or refuse promotional credits, coupons or free-tier benefits that were obtained or used in breach of these Terms or the applicable program terms, including where we reasonably suspect abuse (see Section 6.5).

8. Accounts, Auth Keys and Security

8.1 Account registration. To use parts of the Services, the Customer must create an Account and provide accurate, current and complete information, and keep it up to date. The Customer is responsible for maintaining the security of its Account and all access credentials.

8.2 Auth Keys are confidential. Auth Keys (including the Auth Token) are personal to the Account, must be kept confidential, and must not be shared with, or made accessible to, anyone who is not an Authorized User or the Customer’s own personnel. Auth Keys must not be published, committed to public repositories or otherwise disclosed.

8.3 No sharing or resale. The Customer must not sell, resell, sublicense, rent, lease or otherwise make the Services available to third parties outside the scope permitted by these Terms, except that the Services may be used by the Customer’s Authorized Users in accordance with the selected plan.

8.4 Notification of compromise. The Customer must notify us without undue delay if it becomes aware of any unauthorised use of, or any compromise of, its Account or Auth Keys, and must take reasonable steps to limit and stop the unauthorised use.

8.5 Rotation and revocation. The Customer should rotate Auth Keys after any suspected compromise. We may revoke, rotate or restrict an Auth Key or Account where this is necessary for security, to prevent abuse or to comply with law. Where reasonable and possible, we will notify the Customer and explain how to obtain a new Auth Key.

8.6 Responsibility. The Customer is responsible for all activities that occur under its Account and Auth Keys, except to the extent caused by our breach of these Terms.

9. Software Licence and Intellectual Property

9.1 Licence grant. Subject to these Terms and to payment of the applicable fees, we grant the Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence, for the term of the applicable plan and for the Customer’s own training activities, to:

(a) download, install and run the ShellRoom CLI Agent on Training Servers controlled by the Customer; and (b) access and use the Web Applications.

The Customer may install and run the ShellRoom CLI Agent on as many machines as it wishes, provided each use is within the scope of its plan and these Terms.

9.2 Restrictions. Except to the extent permitted by mandatory law, the Customer must not:

(a) copy, distribute, publish, rent, lease, resell or sublicense the ShellRoom CLI Agent or the Services, or make them available on a standalone or service-bureau basis; (b) reverse engineer, decompile, disassemble or otherwise attempt to derive the source code or underlying ideas of the ShellRoom CLI Agent, except to the extent that such a restriction is prohibited by law (in particular §§ 69d, 69e UrhG) and only to the extent necessary for a permitted purpose; (c) modify, adapt or create derivative works of the ShellRoom CLI Agent, or remove proprietary notices; or (d) use the Services to build a competing product or service.

9.3 Reservation of rights. All rights not expressly granted are reserved. We and our licensors retain all right, title and interest in and to the Services, including all intellectual-property rights, designs, text, graphics, software and their selection and arrangement. All rights in the “ShellRoom” name and logo are reserved; use requires our prior written permission, subject to Section 9.6.

9.4 Open-source components. The ShellRoom CLI Agent may include open-source components licensed under their own terms. Where such terms conflict with these Terms, the open-source terms prevail for those components to the extent required.

9.5 Customer’s intellectual property. The Customer retains all rights in its own data, course materials and configuration. We claim no ownership of Customer Data. Section 11 governs data processing.

9.6 Feedback. The Customer may submit suggestions, ideas or other feedback. Unless we agree otherwise in writing, such feedback is provided voluntarily and at the Customer’s own risk, and the Customer grants us a perpetual, irrevocable, worldwide, royalty-free, sublicensable licence to use, reproduce, modify and exploit the feedback for the operation and improvement of the Services, without obligations of confidentiality or compensation. The Customer warrants that it has the rights necessary to grant this licence.

10. Acceptable Use

10.1 Prohibited uses. The Customer must not, and must ensure that its Authorized Users do not, use the Services or any Training Server through the Services to:

(a) gain unauthorised access to, attack, disrupt, overload or scan any third-party system, network or service, including unauthorised vulnerability scanning or denial-of-service activity; (b) distribute, store or execute malware, ransomware, worms, or other harmful code; (c) mine or farm cryptocurrencies, or run workloads unrelated to the training; (d) steal, harvest or misuse credentials, personal data or confidential information; (e) create, store or transmit content that is unlawful, infringing, defamatory, discriminatory or harmful, or that violates third-party rights; (f) circumvent plan limits, usage limits, Auth Key controls or our security measures; (g) interfere with the integrity, security or operation of the Services or our infrastructure, or impose a disproportionate load on it; (h) send spam or conduct phishing or other deceptive activity; or (i) otherwise violate applicable law.

10.2 Suspension for abuse or security threats. We may temporarily suspend a Terminal Session, Auth Key or Account, or implement technical measures to block access, where we reasonably determine that this is necessary to stop abuse, to prevent an immediate security threat, or to protect the Services, our infrastructure or third parties. Where reasonable and possible, we will notify the Customer. A suspension taken in good faith under this Section does not give rise to liability, without prejudice to Section 15.

10.3 Reporting. The Customer may report abuse or security concerns by writing an email to contact@shellroom.io.

11. Customer Data, Personal Data and Confidentiality

11.1 Categories of data. In providing the Services we may process the following categories of data:

(a) Account data: name, email address, organisation, billing details and technical logs of the Customer’s Account; (b) Authorized User data: participant or trainer names and usernames that the Customer submits; and (c) Technical and session data: connection information, session metadata (such as duration and number of participants) and Terminal Session input/output.

11.2 Roles of the parties; data processing agreement. For Account data, we act as controller under the GDPR. For data relating to Participants and for Terminal Session content processed on the Customer’s behalf, the Customer is the controller and we act as processor. Our processing is governed by our data processing agreement (DPA) under Art. 28 GDPR, which is incorporated into these Terms by reference and available on our DPA page. The DPA is concluded when the Customer accepts these Terms, including by using the Services.

11.3 Terminal input and output. Terminal input and output are transmitted end-to-end encrypted from the ShellRoom CLI to the web browser with keys not accessible to ShellRoom.

11.4 Participant names and login credentials. Depending on the login mode, participant names or usernames may be submitted to our servers. We store such data only for the duration of the session plus a grace period of up to twelve (12) hours, after which it is deleted, unless a longer retention is required by law or agreed in the DPA. Login credentials entered in Virtual Login Mode are handled by the ShellRoom CLI Agent as described in Section 5.3.

11.5 Use of data to improve and develop the Services. We may use data for the following product-improvement purposes:

(a) We may create, retain and use aggregated and statistical data about training sessions — for example their duration, size and usage patterns — for our own purposes, including to analyse, operate, improve and develop the Services. Data that is aggregated or anonymised so that it cannot reasonably be linked to an individual is not personal data.

(b) We may process Account and technical data relating to the Customer’s Account and the Customer’s use of the Services (for example configuration, feature usage, performance, diagnostics, error logs and support interactions) as a controller, in order to operate, secure, analyse, improve and develop the Services and to design new features.

(c) To the extent permitted by the data processing agreement and applicable law, we may also use data relating to Training Sessions in de-identified or pseudonymised form, provided that it cannot reasonably be used to re-identify a person. We may disclose such aggregated or de-identified data to service providers that assist us with these activities.

(d) We do not sell personal data, and we do not use data that identifies a Participant for advertising.

11.6 Customer obligations regarding personal data. The Customer is responsible for:

(a) having a legal basis for providing any personal data to us; (b) informing its Participants, in a transparent way, about the processing of their data in connection with the training and the Services; and (c) ensuring that no special categories of personal data are placed on the Training Server or submitted to the Services where this is not covered by the DPA and applicable law.

11.7 Confidentiality. Each party shall keep confidential the other party’s trade secrets and other confidential information and shall use it only for the purposes of this agreement. Confidential information does not include information that is publicly available through no fault of the receiving party, that was lawfully known without a duty of confidentiality, or that was independently developed.

11.8 Security. We implement reasonable and appropriate technical and organisational measures to secure the Services, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as required by Art. 32 GDPR.

12. Availability, Maintenance, Support and Compatibility

12.1 No uptime guarantee. We do not guarantee any particular availability, uptime or response time for the Services, unless expressly agreed in a separate written service-level agreement.

12.2 Maintenance. We may perform scheduled or unscheduled maintenance. Where reasonable and possible, we will announce planned maintenance in advance. Interim and emergency maintenance may occur without prior notice.

12.3 Changes to the Services. We may further develop, change or discontinue individual features of the Services, provided that (subject to Section 15.1) we do not thereby remove or restrict functions essential to the agreed use in a way that is unreasonable for the Customer. Mandatory statutory rights, including those relating to digital products, remain unaffected.

12.4 Supported environment. The browser-based Web Applications and web terminal currently support current versions of Google Chrome and Mozilla Firefox. Other browsers are not officially supported.

12.5 Customer’s responsibility for connectivity. The Customer is responsible for its own internet connection, network configuration and the availability and performance of its Training Server and of any conferencing system it uses.

12.6 Support. We provide technical support by email at contact@shellroom.io (Section 18.10). Support is available on German business days — Monday to Friday, excluding statutory public holidays at our registered office in Saxony — 08:00–15:00 UTC. We will use reasonable efforts to respond to support requests within one (1) business day. Support is subject to Section 12.1; we do not guarantee any particular response or resolution time, and service levels apply only if agreed separately in writing.

13. Term, Suspension and Termination

13.1 Term. These Terms apply for as long as the Customer uses the Services. Paid Plan subscriptions run for successive monthly periods as described in Section 7.

13.2 Termination for convenience. The Customer may terminate a Paid Plan subscription at any time with effect at the end of the then-current billing period (Section 7.5). We may terminate the Free Plan or a subscription for convenience with reasonable notice, subject to mandatory statutory rights.

13.3 Termination for cause. Either party may terminate these Terms for cause with immediate effect by written notice if the other party materially breaches these Terms and fails to remedy the breach within a reasonable period set in a warning notice, or if termination with immediate effect is justified taking into account both parties’ interests. We may in particular terminate for cause if the Customer breaches Section 9.2 or Section 10.

13.4 Suspension. Section 10.2 (suspension for abuse or security threats) and Section 7.8 (overdue amounts) apply. A suspension does not automatically terminate these Terms.

13.5 Effect of termination. On termination:

(a) at the end of the paid period, the Account falls back to the Free Plan, unless the Account itself is deleted; (b) any accrued payment obligations remain due.

13.6 End-of-service. If we intend to discontinue the Services in whole, we will give at least thirty (30) days’ advance notice in text form and will, where technically feasible and legally permitted, provide a reasonable opportunity to export Account data. Mandatory statutory rights, including those of Consumers, remain unaffected.

13.7 Survival. Sections that by their nature should survive termination (for example Sections 9.2, 9.3, 11.7, 15, 16 and 18) survive.

14. Warranties

14.1 Warranty. We warrant that the Services, when used as intended and in accordance with the documentation, will substantially provide the described functionality during the applicable subscription period. Our liability for defects is governed by statutory law, subject to the limitations in Section 15.

14.2 Statutory rights. The statutory rights of the Customer in respect of digital products and digital services (in particular §§ 327 ff., 434 ff. BGB) remain unaffected and may not be reduced by these Terms.

14.3 Updates. We may provide updates to the ShellRoom CLI Agent and the Services to maintain conformity or to improve functionality. The Customer consents to updating of the ShellRoom CLI Agent to the extent the update does not materially reduce the agreed functionality.

14.4 No guarantee of results. We do not warrant that training sessions will achieve a particular learning outcome, that the Services will be error-free, or that they will resolve any particular problem in the Customer’s environment. Statutory rights, including mandatory conformity rights, remain unaffected.

15. Liability

15.1 Unlimited liability. We are liable without limitation:

(a) for damages caused intentionally or by gross negligence by us, our legal representatives or our agents; (b) for damages arising from injury to life, body or health caused by our fault; (c) for damages covered by an express guarantee given by us, or by a warranty of quality or durability given by us; (d) for damages caused by fraudulent concealment of a defect; (e) under the German Product Liability Act (ProdHaftG); and (f) in all other cases in which liability is mandatory by law.

15.2 Liability for simple negligence. Where we cause damage by simple negligence, we are liable only for breach of a material contractual obligation. A material contractual obligation is one whose fulfilment is necessary for the proper performance of the contract and on whose observance the Customer regularly relies and may rely. In this case, our liability is limited to the damage that was reasonably foreseeable and typical for this type of contract.

15.3 Exclusion. Except as provided in Sections 15.1 and 15.2, our liability for simple negligence is excluded.

15.4 Data loss. To the extent our liability for loss of data is not excluded, it is limited to the damage that would have been avoided had the Customer performed regular and appropriate backups — which the Customer is responsible for under Section 4.3(f). This does not apply where the loss was caused by a breach of Section 10.2 or where a backup was within our exclusive sphere of responsibility.

15.5 Cap. For claims under Section 15.2, our liability is limited to the amount the Customer paid us in the twelve (12) months preceding the event giving rise to the claim.

15.6 No typical-type exclusions for Consumers. The limitations in this Section do not apply to Consumers to the extent this would conflict with mandatory consumer-protection law, in particular § 309 Nr. 7 BGB.

15.7 Limitation periods. Statutory limitation periods apply.

16. Indemnification by the Customer

16.1 The Customer shall indemnify and hold harmless ShellRoom, its legal representatives, employees and agents from and against all claims, damages, liabilities, costs and expenses (including reasonable legal fees) brought by third parties arising out of or relating to:

(a) the Customer’s breach of these Terms, including Section 4 (Training Server), Section 9.2 (licence restrictions) or Section 10 (acceptable use); (b) content, software or data that the Customer or its Authorized Users place on a Training Server or submit through the Services, including claims of infringement of third-party rights; (c) the Customer’s violation of applicable law, in particular in connection with the conduct of training or the processing of personal data; and (d) activity conducted by the Customer or its Authorized Users on third-party systems.

16.2 This obligation does not apply to the extent the claim was caused by ShellRoom’s own breach of these Terms, by our violation of law, or by our fault, and applies only to the extent permitted by law. Statutory rights of the Customer remain unaffected.

17. Changes to the Services and these Terms

17.1 Changes to these Terms. We may amend these Terms to the extent this is necessary to adapt to changes in law, court rulings, the technical environment or the scope of the Services, or for other objectively justified reasons, provided the amendments are reasonable for the Customer taking into account the nature of the change and the parties’ interests.

17.2 Notice. We will notify the Customer of changes in good time — normally at least six (6) weeks before they take effect — in text form (by email, or by a notice in the Web Applications), and will state the reasons and the effective date. Where a change is significant, we will make the Customer’s right to object or terminate clear.

17.3 Objection and cancellation. If the Customer does not agree with a change, it may cancel its subscription with effect from the effective date of the change, and may terminate its Account at any time. If the change is significant, we will highlight the Customer’s right to object or terminate.

17.4 Changes required by law; consent by continued use. (a) Changes required by law may take effect without the Customer’s consent, with reasonable notice under Section 17.2. (b) For all other changes under this Section, the Customer’s continued use of the Services after the effective date, or the Customer’s failure to object before that date, is treated as the Customer’s agreement to the change, provided that the notice under Section 17.2 expressly informs the Customer of this consequence and grants the Customer a reasonable period to object. If the Customer objects before the effective date, the change does not apply to the Customer’s Account and the Customer’s right to terminate under Section 17.3 remains unaffected.

18. Governing Law, Jurisdiction and Miscellaneous

18.1 Governing law. These Terms and the contractual relationship between the parties are governed by the laws of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG) and excluding the German conflict-of-law rules.

18.2 Consumers. Where the Customer is a Consumer, the mandatory provisions of the law of the country in which the Consumer has its habitual residence (Art. 6 Rome I) remain unaffected.

18.3 Jurisdiction. If the Customer is a Business Customer, a legal person under public law or a special fund under public law, the exclusive place of jurisdiction for all disputes arising out of or in connection with these Terms is Leipzig. If the Customer is a Consumer, the statutory places of jurisdiction apply.

18.4 Notices. Declarations of legal significance under these Terms must be made in text form (for example by email) unless a stricter form is required by law. Notices to us must be sent to the email address in Section 18.10. We may send notices to the email address last stored in the Account.

18.5 Assignment. The Customer may assign or transfer rights and obligations under these Terms only with our prior written consent, except to a successor of substantially its entire business. We may assign these Terms to a successor of substantially our entire business, provided this does not unreasonably disadvantage the Customer.

18.6 Severability. If a provision of these Terms is invalid or unenforceable, the remaining provisions remain valid and enforceable. In place of the invalid or unenforceable provision, the statutory law applies.

18.7 Entire agreement. These Terms, together with the order and the incorporated documents (privacy policy, third-party notices, DPA), constitute the entire agreement regarding the subject matter. Any conflicting terms of the Customer’s purchase orders are rejected.

18.8 Force majeure. Neither party is liable for breaches of its obligations caused by events beyond its reasonable control, including natural disasters, official measures, or failures of third-party infrastructure, unless the party could reasonably have prevented or mitigated the event.

18.9 Export and sanctions. The Services are subject to applicable export-control and sanctions laws, including those of the European Union, the United States and other relevant jurisdictions. The Customer must not use, export or re-export the Services in violation of those laws, must not use the Services in embargoed countries or from a location subject to comprehensive sanctions, and represents that it is not listed on any applicable denied-persons, entity or sanctions list.

18.10 Contact. For questions and notices regarding these Terms, please write an email to contact@shellroom.io.

18.11 Right of withdrawal for Consumers. Where the Customer is a Consumer and enters into a distance contract for a Paid Plan, the Consumer has a right of withdrawal under §§ 312g, 355 BGB, unless an exception applies (for example, where the digital product has been supplied in full with the Consumer’s prior express consent and acknowledgement of loss of the withdrawal right).

18.12 Language and binding version. These Terms are drafted in English and are binding.

18.13 Order of precedence. In case of conflict, the order of precedence is: (1) the order or individual agreement, (2) these Terms, (3) the DPA, (4) the privacy policy, (5) other referenced documents.