General terms and conditions CRA Response Center

Last updated: 19 October 2026. This is a translation; the German version is binding.

1. Provider and scope

These general terms and conditions (terms) apply to all contracts for the service "CRA Response Center" between WDM Webdesign München GmbH, Deisenhofener Str. 45, 81539 München, Germany ("we") and its customers. Any differing terms of the customer apply only if we expressly agree to them in text form.

The service is offered exclusively to businesses within the meaning of section 14 of the German Civil Code (BGB), that is, natural or legal persons and partnerships with legal capacity acting in the exercise of their trade, business or profession when the contract is concluded. Consumers cannot conclude a contract, and there is no right of withdrawal. By registering, the customer confirms that it is acting as a business.

2. Service

CRA Response Center is a browser application at app.cra-response-center.com. It monitors the customer's security mailboxes, which the customer connects by forwarding them to a virtual mailbox with us. The service comprises the classification of incoming e-mails using fixed rules and an AI operated in Germany, alerts to the people the customer has entered, by e-mail and optionally also by SMS, a display of the deadlines under Article 14 of Regulation (EU) 2024/2847 (Cyber Resilience Act) from the awareness confirmed by the customer, a history recording who did what and when, and a daily check of the security.txt of every domain entered. The application itself describes the exact range of functions.

The service does not include legal advice, the decision whether a case must be reported, or notifications to authorities such as ENISA or a CSIRT; the customer submits such notifications itself. CRA Response Center is a private service provider, not a public authority, and is not connected with any authority.

Classification by rules and AI is an aid, not a guarantee. It can be wrong and, for example, rate an important e-mail as unimportant. The customer remains responsible for reviewing incoming reports and for meeting its obligations under the Cyber Resilience Act. The original of every e-mail stays in the customer's mailbox.

3. Conclusion of contract and trial period

The contract is concluded when the customer registers in the application and accepts these terms and the data processing agreement; when registering with a password, it is concluded once the customer has also confirmed its e-mail address. Registration is also possible with a Google or Microsoft account.

The first 30 days from registration are free of charge (trial period). When registering, the customer provides payment details to our payment service provider Stripe. If the customer has provided them by the end of the trial period, the trial period turns into the paid subscription without any further declaration. If not, access ends with the trial period: monitoring stops until payment details are provided. A customer who cancels within the trial period pays nothing.

4. Prices and payment

The fee is EUR 190 per month per domain with one monitored mailbox and EUR 30 per month for each additional mailbox on the same domain. All prices include statutory VAT. If the customer is established in another Member State of the European Union and provides a valid VAT identification number, it is invoiced without German VAT and the customer accounts for the tax itself (reverse charge).

Invoicing is monthly in advance via Stripe, by card or SEPA Direct Debit. The customer receives the invoice by e-mail. If the customer adds or removes domains or mailboxes, the fee for the current month is adjusted pro rata.

We may change the prices by giving at least 30 days' notice in text form. The customer may cancel until the change takes effect; we point this out in the notice. If the customer does not cancel, the new prices apply from the date announced.

5. Term and cancellation

The contract runs for an indefinite period. The customer can cancel at any time in the application under Settings > Subscription. The subscription ends immediately and nothing further is charged. Periods already paid for, including the current month, are not refunded. On cancellation, the customer's account and data are deleted, except for information we are required by law to retain, such as invoices.

We may terminate the contract by giving 30 days' notice in text form. The right to terminate without notice for good cause remains unaffected. Good cause exists in particular if the customer misuses the application (section 6) or is in default of payment. In the event of default of payment, we may instead suspend access until payment has been received.

6. Customer obligations

The customer sets up forwarding of its security mailboxes to the virtual mailbox and keeps it working; the application cannot see e-mails that are not forwarded. The customer enters the people to be alerted with current e-mail addresses and mobile numbers, keeps this information up to date and makes sure that the people entered can be reached and read their alerts.

The customer keeps its access credentials secret and informs us without delay of any suspected misuse. The customer does not misuse the application and in particular does not connect mailboxes of other parties' domains, does not process unlawful content through it and does not disrupt or attack the application.

After set-up and after significant changes to forwarding or people, the customer triggers a test alert and checks that everyone entered has received it.

7. Availability and changes

We aim for high availability of the application but do not commit to any specific level of availability. Interruptions may result in particular from maintenance, faults at third parties, for example in mobile and e-mail networks, or force majeure. Where possible, we schedule maintenance at times of low usage.

We continue to develop the application and may change, add or replace functions, provided the core of the service under section 2 is preserved and the change is reasonable for the customer. We notify changes to these terms in text form at least 30 days before they take effect; the customer may cancel until then.

8. Data protection

Where we process personal data on behalf of the customer, for example in forwarded e-mails or for the people entered, we do so as a processor under the data processing agreement under Article 28 GDPR, which the customer concludes in the application when registering. Processing takes place in Germany. Stripe handles payment as an independent controller. Details are set out in the privacy policy.

9. Liability

We are liable without limitation for intent and gross negligence, for injury to life, body or health, under the German Product Liability Act (Produkthaftungsgesetz) and where we have given a guarantee.

In cases of slight negligence, we are liable only for breach of material contractual obligations, meaning obligations whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the customer may regularly rely. Liability is then limited to the foreseeable damage typical for the contract, and at most to the fees the customer paid in the twelve months before the event causing the damage.

To the extent permitted by law, we are not liable for missed deadlines and resulting damage where they are due to the customer taking note of an alert late, e-mails not being forwarded to the virtual mailbox on the customer's side, the AI classifying an e-mail incorrectly, or failures of mobile and e-mail networks outside our area of responsibility.

The above limitations also apply in favour of our legal representatives, employees and vicarious agents.

10. Final provisions

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods. If the customer is a merchant, a legal entity under public law or a special fund under public law, the place of jurisdiction is Munich.

Declarations relating to the contract must be made in text form, for example by e-mail, unless these terms provide otherwise; for cancellation by the customer, cancelling in the application is sufficient.

If any provision of these terms is invalid, the remaining provisions remain valid. The statutory provision takes the place of the invalid provision.

These terms are available in German and English. The German version is binding.